# Kubernetes deployment

Self-hostable manifests for Legate Agent (kustomize).

## Prerequisites

- A cluster with an ingress controller (nginx) and cert-manager, or swap the
  ingress for your own TLS termination (e.g. the Caddy prod compose).
- Container images pushed to a registry — build from `apps/api` and `apps/web`
  and update the `image:` fields (they default to `ghcr.io/sanmaxdev/legate-*`).

## Deploy

```bash
# 1. Create the namespace + secrets (never commit real secrets).
kubectl apply -f namespace.yaml
cp secret.example.yaml secret.yaml && $EDITOR secret.yaml
kubectl apply -f secret.yaml

# 2. Apply everything else.
kubectl apply -k .
```

The `api` Deployment runs `alembic upgrade head` as an init container, so schema
migrations apply automatically on rollout.

## Notes

- For production, point `DATABASE_URL` / `REDIS_URL` at managed services and drop
  the in-cluster `postgres` / `redis` from `data.yaml`.
- Metrics are scraped from `api:8000/metrics` (Prometheus annotations are set).
- Enable tracing by setting `OTEL_EXPORTER_OTLP_ENDPOINT` in the ConfigMap.
- Scale statelessly: bump `api` / `web` / `worker` replicas. Run exactly one
  `beat` replica (it schedules cron workflows).
