# 1536-dim production-representative benchmark — the REAL thepeach shape.
#
# Mix: `peach` (feed-profile reads + signal writes in production ratio), NOT
# write-only. Embeddings: 1536-dim (text-embedding-3-small), the production width.
# The feed read exercises tidaldb's named-profile retrieve (db.retrieve(profile)),
# which is what thepeach E2/R8 (services/api/feed.rs) will call.
# First run on the m11-44b768b image: confirms the HTTPS :9500 client plane,
# cluster-key auth, and m11p6 single-group replication all carry a real write
# load end-to-end, and re-establishes the T2-A capacity number on the new stack.
#
# TLS: the :9500 plane serves a private-CA cert (tidaldb-cluster-tls). The
# generator trusts it via the mounted ca.crt (--ca-cert) — verified TLS, not
# --insecure. Targets MUST be https:// and use the cert's DNS SANs (pod-DNS / VIP),
# never pod IPs (not in the SAN list).
#
# Apply:  kubectl apply -f tidal-stress/k8s/stress-job-m11p6-baseline.yaml
# Watch:  kubectl logs -f job/tidal-stress-1536 -n tidaldb-cluster
# Rearm:  kubectl delete job tidal-stress-1536 -n tidaldb-cluster
apiVersion: batch/v1
kind: Job
metadata:
  name: tidal-stress-1536
  namespace: tidaldb-cluster
  labels:
    app.kubernetes.io/name: tidal-stress
    app.kubernetes.io/part-of: tidaldb
spec:
  backoffLimit: 0
  ttlSecondsAfterFinished: 7200
  template:
    metadata:
      labels:
        app.kubernetes.io/name: tidal-stress
        app.kubernetes.io/part-of: tidaldb
    spec:
      restartPolicy: Never
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: stress
          image: registry.threesix.ai/tidal/stress@sha256:e130aa871f5df17a14a9e13e7df606c602b95a03d8eba49490ff7481e6e2b2b3  # m11-44b768b (TLS-aware)
          imagePullPolicy: IfNotPresent
          args:
            - --target
            - https://tidaldb-0.tidaldb-peers.tidaldb-cluster.svc.cluster.local:9500
            - --target
            - https://tidaldb-1.tidaldb-peers.tidaldb-cluster.svc.cluster.local:9500
            - --target
            - https://tidaldb-2.tidaldb-peers.tidaldb-cluster.svc.cluster.local:9500
            - --leader-url
            - https://tidaldb.tidaldb-cluster.svc.cluster.local:9500   # VIP — routes to any ready pod; m11p6 hash-routes writes to the group leader
            - --ca-cert
            - /etc/tidaldb/tls/ca.crt
            - --ack
            - quorum
            - --ramp
            - peach-100k
            - --stage-secs
            - "120"
            - --mix
            - peach
            - --embedding-dim
            - "1536"            # thepeach production width (text-embedding-3-small)
            - --corpus
            - "20000"
            - --users
            - "100000"
            - --poll-status
          env:
            - name: TIDAL_API_KEY
              valueFrom:
                secretKeyRef:
                  name: tidaldb-credentials
                  key: TIDAL_API_KEY
            - name: TIDAL_STRESS_LOG
              value: warn
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              cpu: "3"
              memory: 1Gi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: cluster-tls
              mountPath: /etc/tidaldb/tls
              readOnly: true
      volumes:
        - name: cluster-tls
          secret:
            secretName: tidaldb-cluster-tls
            items:
              - key: ca.crt
                path: ca.crt