bikoret/deploy/k8s/deployment.yaml

# Shorashim Deployment — the mishkan
#
# Shemot 40:33 — Vay'khal Mosheh et ham'lakhah.
#
# Architecture §5.1: All inter-component communication uses
# JSON over Unix domain sockets or Erlang distribution protocol.
# No HTTP between internal components.
#
# L1 Torah is baked into each container image (~29MB).
# The scroll is sealed in the aron. It ships with the vessel.
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: shorashim
  namespace: shorashim
  labels:
    app.kubernetes.io/name: shorashim
    app.kubernetes.io/version: "0.1.0"
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: shorashim
  template:
    metadata:
      labels:
        app.kubernetes.io/name: shorashim
    spec:
      # --- VOLUMES ---
      volumes:
        - name: manna
          emptyDir: {}
        - name: talmudic-socket
          emptyDir: {}
        - name: tmp-shorashim
          emptyDir: {}

      # --- IMAGE PULL SECRET ---
      imagePullSecrets:
        - name: shorashim-registry

      # --- INIT CONTAINER: Run L3 migrations ---
      initContainers:
        - name: migrate
          image: exo.container-registry.com/the-recognition-protocol/vav-pipeline:latest
          command: ["./app/bin/vav_pipeline", "eval", "VavPipeline.Release.migrate()"]
          envFrom:
            - configMapRef:
                name: shorashim-config
            - secretRef:
                name: shorashim-secrets

      # --- CONTAINERS ---
      containers:
        # === VAV PIPELINE (main) ===
        - name: vav-pipeline
          image: exo.container-registry.com/the-recognition-protocol/vav-pipeline:latest
          ports:
            - containerPort: 4000
              name: http
          envFrom:
            - configMapRef:
                name: shorashim-config
            - secretRef:
                name: shorashim-secrets
          volumeMounts:
            - name: manna
              mountPath: /var/lib/shorashim/manna
            - name: talmudic-socket
              mountPath: /tmp/shorashim
            - name: tmp-shorashim
              mountPath: /tmp
          resources:
            requests:
              memory: "256Mi"
              cpu: "250m"
            limits:
              memory: "1Gi"
              cpu: "1000m"
          livenessProbe:
            httpGet:
              path: /kodesh/health
              port: 4000
            initialDelaySeconds: 30
            periodSeconds: 60
          readinessProbe:
            httpGet:
              path: /kodesh/health
              port: 4000
            initialDelaySeconds: 10
            periodSeconds: 10

        # === SHORESH ENGINE (sidecar) ===
        - name: shoresh-engine
          image: exo.container-registry.com/the-recognition-protocol/shoresh-engine:latest
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"

        # === TALMUDIC ENGINE (sidecar) ===
        - name: talmudic-engine
          image: exo.container-registry.com/the-recognition-protocol/talmudic-engine:latest
          volumeMounts:
            - name: talmudic-socket
              mountPath: /tmp/shorashim
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"

        # === KORBAN PROCESSOR (sidecar) ===
        # Korban_processor imports azazel_processor (the disposal
        # channel) in the same Python process. The Python side writes
        # AzazelRecord JSON files to /tmp/shorashim/azazel/pending_l3/;
        # vav-pipeline's AzazelIngest GenServer watches that directory
        # and ingests into L3. Both containers must mount the shared
        # tmp-shorashim volume for the file bridge to work.
        - name: korban-processor
          image: exo.container-registry.com/the-recognition-protocol/korban-processor:latest
          volumeMounts:
            - name: tmp-shorashim
              mountPath: /tmp
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"