# The entire discover-specific delta to the vendored copy of k8s/statefulset.yaml.
#
# A STRATEGIC-MERGE patch, not JSON 6902: `volumes`, `containers` and `env` all
# carry `name` as their patch merge key, so every field below is addressed by a
# stable identifier. The JSON-6902 equivalent would need positional indices
# (/spec/template/spec/volumes/0/..., /spec/template/spec/containers/0/env/0/...)
# which silently patch the wrong element the moment the base list order changes.
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: tidaldb
spec:
  # The base is parked at 0; scripts/restore-fleet.sh is the base's only
  # supported scale-up path, so the overlay does the scaling instead of editing
  # the base out from under its other consumers. 1 is the ceiling: tidalDB is
  # single-node-first and scales vertically.
  replicas: 1
  # kustomize's nameReference transformer cannot follow the metadata.name rename
  # in kustomization.yaml (patch-driven renames are opaque to it), so the
  # headless Service name is restated here. It MUST equal the Service's rendered
  # name or the pod gets no stable DNS record.
  serviceName: tidaldb-discover
  template:
    spec:
      volumes:
        # Replaces the base's 128-dimension `tidaldb-schema` ConfigMap with the
        # discover schema (view/like/completion signals, title+category text,
        # content_vector at 1536, the rg_discover ranking profile).
        - name: schema
          configMap:
            name: tidaldb-discover-schema
      containers:
        - name: tidaldb
          env:
            # Without TIDAL_API_KEY the server leaves every data route
            # unauthenticated — an open instance inside the cluster. The Secret
            # is provisioned out-of-band through GCP Secret Manager (never
            # `kubectl create secret`) and is deliberately not part of this
            # kustomization, so no key is ever committed.
            - name: TIDAL_API_KEY
              valueFrom:
                secretKeyRef:
                  name: tidaldb-discover-api-key
                  key: api-key