# Beispiel für OpenShift (Namespace, Registry und Hosts anpassen). Braucht keine Cluster-Admin-Rechte.
apiVersion: v1
kind: Secret
metadata:
  name: db-mcp-postgres
type: Opaque
stringData:
  # name:geheimnis, kommagetrennt; Bifröst bekommt einen eigenen Schlüssel
  DBMCP_API_KEYS: "bifroest:BITTE-ERSETZEN-mindestens-16-zeichen"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: db-mcp-postgres
spec:
  replicas: 2
  selector:
    matchLabels: {app: db-mcp-postgres}
  template:
    metadata:
      labels: {app: db-mcp-postgres}
    spec:
      automountServiceAccountToken: false
      containers:
        - name: dienst
          image: registry.intern/db-mcp-postgres:0.1.0
          ports: [{containerPort: 8080}]
          env:
            - {name: DBMCP_ALLOWED_HOSTS, value: "pg1.db.intern,.analytics.db.intern"}
            - {name: DBMCP_HTTP_HOSTS, value: "db-mcp-postgres,db-mcp-postgres:8080"}
            - {name: DBMCP_MAX_ROWS, value: "500"}
          envFrom: [{secretRef: {name: db-mcp-postgres}}]
          readinessProbe: {httpGet: {path: /ready, port: 8080}}
          livenessProbe: {httpGet: {path: /live, port: 8080}}
          resources:
            requests: {cpu: 100m, memory: 128Mi}
            limits: {cpu: "1", memory: 512Mi}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            capabilities: {drop: [ALL]}
            seccompProfile: {type: RuntimeDefault}
---
apiVersion: v1
kind: Service
metadata:
  name: db-mcp-postgres
spec:
  selector: {app: db-mcp-postgres}
  ports: [{port: 8080, targetPort: 8080}]
---
# Nur Bifröst (bzw. freigegebene Clients) darf den Dienst aufrufen
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-mcp-postgres-ingress
spec:
  podSelector: {matchLabels: {app: db-mcp-postgres}}
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector: {matchLabels: {app: bifrost-web}}
        - podSelector: {matchLabels: {app: bifrost-worker}}
      ports: [{port: 8080}]
---
# Der Dienst darf nur zu den PostgreSQL-Servern (und DNS)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-mcp-postgres-egress
spec:
  podSelector: {matchLabels: {app: db-mcp-postgres}}
  policyTypes: [Egress]
  egress:
    - to: [{ipBlock: {cidr: 10.20.30.0/24}}]   # Netz der PostgreSQL-Server
      ports: [{port: 5432}]
    - to: [{namespaceSelector: {}, podSelector: {matchLabels: {dns.operator.openshift.io/daemonset-dns: default}}}]
      ports: [{port: 5353, protocol: UDP}, {port: 5353, protocol: TCP}]