bikoret/deploy/k8s/deployment.yaml

# Shorashim Deployment — the mishkan
#
# Architecture §5.1: All inter-component communication uses
# JSON over Unix domain sockets or Erlang distribution protocol.
# No HTTP between internal components.
#
# The vav_pipeline (BEAM) runs the Sanhedrin, Chatzotzrot,
# AreiMiklat, EglahArufah, Bikurim, MannaLedger, ShabbatTimer.
# The shoresh-engine runs as a sidecar (Erlang Port).
# The talmudic_engine runs as a sidecar (Unix socket).
# The korban_processor runs as a sidecar (invoked by pipeline).
#
# L1 is mounted read-only into all containers.
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: shorashim
  namespace: shorashim
  labels:
    app.kubernetes.io/name: shorashim
    app.kubernetes.io/version: "0.1.0"
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: shorashim
  template:
    metadata:
      labels:
        app.kubernetes.io/name: shorashim
    spec:
      # --- VOLUMES ---
      volumes:
        - name: l1-torah
          persistentVolumeClaim:
            claimName: l1-torah-pvc
            readOnly: true
        - name: manna
          persistentVolumeClaim:
            claimName: manna-pvc
        - name: talmudic-socket
          emptyDir: {}
        - name: tmp-shorashim
          emptyDir: {}

      # --- INIT CONTAINER: Run L3 migrations ---
      initContainers:
        - name: migrate
          image: exo.container-registry.com/the-recognition-protocol/vav-pipeline:latest
          command: ["./app/bin/vav_pipeline", "eval", "VavPipeline.Release.migrate()"]
          envFrom:
            - configMapRef:
                name: shorashim-config
            - secretRef:
                name: shorashim-secrets
          volumeMounts:
            - name: l1-torah
              mountPath: /mnt/torah
              readOnly: true

      # --- CONTAINERS ---
      containers:
        # === VAV PIPELINE (main) ===
        - name: vav-pipeline
          image: exo.container-registry.com/the-recognition-protocol/vav-pipeline:latest
          ports:
            - containerPort: 4000
              name: http
          envFrom:
            - configMapRef:
                name: shorashim-config
            - secretRef:
                name: shorashim-secrets
          env:
            - name: SHORESH_ENGINE_BINARY
              value: "/home/shorashim/shoresh-engine"
          volumeMounts:
            - name: l1-torah
              mountPath: /mnt/torah
              readOnly: true
            - name: manna
              mountPath: /var/lib/shorashim/manna
            - name: talmudic-socket
              mountPath: /tmp/shorashim
            - name: tmp-shorashim
              mountPath: /tmp
          resources:
            requests:
              memory: "256Mi"
              cpu: "250m"
            limits:
              memory: "1Gi"
              cpu: "1000m"
          livenessProbe:
            httpGet:
              path: /kodesh/health
              port: 4000
            initialDelaySeconds: 30
            periodSeconds: 60
          readinessProbe:
            httpGet:
              path: /kodesh/health
              port: 4000
            initialDelaySeconds: 10
            periodSeconds: 10

        # === SHORESH ENGINE (sidecar) ===
        - name: shoresh-engine
          image: exo.container-registry.com/the-recognition-protocol/shoresh-engine:latest
          volumeMounts:
            - name: l1-torah
              mountPath: /mnt/torah
              readOnly: true
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"

        # === TALMUDIC ENGINE (sidecar) ===
        - name: talmudic-engine
          image: exo.container-registry.com/the-recognition-protocol/talmudic-engine:latest
          volumeMounts:
            - name: l1-torah
              mountPath: /mnt/torah
              readOnly: true
            - name: talmudic-socket
              mountPath: /tmp/shorashim
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"

        # === KORBAN PROCESSOR (sidecar) ===
        - name: korban-processor
          image: exo.container-registry.com/the-recognition-protocol/korban-processor:latest
          volumeMounts:
            - name: l1-torah
              mountPath: /mnt/torah
              readOnly: true
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"