# Matches docker-compose's workspace-data volume: a PVC mounted at
# /data/workspace. Single replica + Recreate, same reasoning as the
# databases — this is where run_bash_command actually executes, so a
# second concurrent pod writing the same tree would be worse than a
# brief restart gap.
apiVersion: v1
kind: PersistentVolumeClaim
metadata: {name: workspace-data, namespace: enkly}
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: managed-nfs-storage
  resources: {requests: {storage: 10Gi}}
---
apiVersion: apps/v1
kind: Deployment
metadata: {name: workspace, namespace: enkly, labels: {app: workspace}}
spec:
  replicas: 1
  strategy: {type: Recreate}
  selector: {matchLabels: {app: workspace}}
  template:
    metadata: {labels: {app: workspace}}
    spec:
      imagePullSecrets: [{name: enkly-registry}]
      containers:
        - name: workspace
          image: registry.enkly.org/enkly/workspace:latest
          ports: [{name: grpc, containerPort: 9004}]
          envFrom: [{configMapRef: {name: enkly-config}}]
          resources:
            requests: {cpu: 100m, memory: 128Mi}
            limits: {cpu: 1, memory: 512Mi}
          readinessProbe: {grpc: {port: 9004}, initialDelaySeconds: 5, periodSeconds: 10, failureThreshold: 10}
          livenessProbe: {grpc: {port: 9004}, initialDelaySeconds: 15, periodSeconds: 20, failureThreshold: 6}
          volumeMounts: [{name: data, mountPath: /data/workspace}]
      volumes:
        - name: data
          persistentVolumeClaim: {claimName: workspace-data}
---
apiVersion: v1
kind: Service
metadata: {name: workspace, namespace: enkly, labels: {app: workspace}}
spec:
  selector: {app: workspace}
  ports: [{name: grpc, port: 9004, targetPort: grpc}]