---
apiVersion: v1
kind: Namespace
metadata:
  name: valkey
  labels:
    app.kubernetes.io/name: valkey
    app.kubernetes.io/component: database

---
apiVersion: v1
kind: Secret
metadata:
  name: valkey-auth
  namespace: valkey
  labels:
    app.kubernetes.io/name: valkey
    app.kubernetes.io/component: database
type: Opaque
stringData:
  # CHANGE THIS: Generate a strong password with: openssl rand -base64 32
  password: "REPLACE_WITH_STRONG_PASSWORD"

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: valkey-config
  namespace: valkey
  labels:
    app.kubernetes.io/name: valkey
    app.kubernetes.io/component: database
data:
  valkey.conf: |
    # Persistence
    appendonly yes
    appendfsync everysec
    auto-aof-rewrite-percentage 100
    auto-aof-rewrite-min-size 64mb
    
    # Memory
    maxmemory 256mb
    maxmemory-policy allkeys-lru
    
    # Network
    bind 0.0.0.0
    port 6379
    tcp-backlog 511
    timeout 0
    tcp-keepalive 300
    
    # Logging
    loglevel notice
    
    # Security
    protected-mode yes
    requirepass REPLACE_PASSWORD_PLACEHOLDER

---
apiVersion: v1
kind: Service
metadata:
  name: valkey
  namespace: valkey
  labels:
    app.kubernetes.io/name: valkey
    app.kubernetes.io/component: database
  annotations:
    service.kubernetes.io/topology-aware-hints: auto
spec:
  type: ClusterIP
  clusterIP: None  # Headless service for StatefulSet
  ports:
    - name: valkey
      port: 6379
      targetPort: 6379
      protocol: TCP
  selector:
    app.kubernetes.io/name: valkey
    app.kubernetes.io/component: database

---
apiVersion: v1
kind: Service
metadata:
  name: valkey-client
  namespace: valkey
  labels:
    app.kubernetes.io/name: valkey
    app.kubernetes.io/component: database
  annotations:
    service.kubernetes.io/topology-aware-hints: auto
spec:
  type: ClusterIP
  ports:
    - name: valkey
      port: 6379
      targetPort: 6379
      protocol: TCP
  selector:
    app.kubernetes.io/name: valkey
    app.kubernetes.io/component: database

---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: valkey
  namespace: valkey
  labels:
    app.kubernetes.io/name: valkey
    app.kubernetes.io/component: database
    app.kubernetes.io/version: "8.0"  # CHANGE THIS: Update to match your Valkey version
  annotations:
    owner: "platform-team"  # CHANGE THIS: Set to your team
spec:
  serviceName: valkey
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: valkey
      app.kubernetes.io/component: database
  template:
    metadata:
      labels:
        app.kubernetes.io/name: valkey
        app.kubernetes.io/component: database
        app.kubernetes.io/version: "8.0"  # CHANGE THIS: Update to match your Valkey version
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "6379"
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 999
        runAsGroup: 999
        fsGroup: 999
        fsGroupChangePolicy: "OnRootMismatch"
        seccompProfile:
          type: RuntimeDefault
      
      initContainers:
        - name: config-init
          image: valkey/valkey:8.0-alpine  # CHANGE THIS: Update version as needed
          command:
            - sh
            - -c
            - |
              cp /tmp/valkey/valkey.conf /etc/valkey/valkey.conf
              sed -i "s/REPLACE_PASSWORD_PLACEHOLDER/$(cat /etc/valkey-secret/password)/" /etc/valkey/valkey.conf
          volumeMounts:
            - name: config
              mountPath: /tmp/valkey
            - name: valkey-config
              mountPath: /etc/valkey
            - name: valkey-secret
              mountPath: /etc/valkey-secret
              readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: false
      
      containers:
        - name: valkey
          image: valkey/valkey:8.0-alpine  # CHANGE THIS: Update version as needed
          imagePullPolicy: IfNotPresent
          command:
            - valkey-server
            - /etc/valkey/valkey.conf
          ports:
            - name: valkey
              containerPort: 6379
              protocol: TCP
          
          env:
            - name: VALKEY_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: valkey-auth
                  key: password
          
          resources:
            requests:
              cpu: 100m      # CHANGE THIS: Adjust based on workload
              memory: 384Mi  # CHANGE THIS: Should be ~1.5x maxmemory setting
            limits:
              cpu: 500m      # CHANGE THIS: Adjust based on workload
              memory: 512Mi  # CHANGE THIS: Should be ~2x maxmemory setting
          
          livenessProbe:
            exec:
              command:
                - sh
                - -c
                - valkey-cli -a "$VALKEY_PASSWORD" ping | grep -q PONG
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 3
          
          readinessProbe:
            exec:
              command:
                - sh
                - -c
                - valkey-cli -a "$VALKEY_PASSWORD" ping | grep -q PONG
            initialDelaySeconds: 10
            periodSeconds: 5
            timeoutSeconds: 3
            successThreshold: 1
            failureThreshold: 3
          
          volumeMounts:
            - name: data
              mountPath: /data
            - name: valkey-config
              mountPath: /etc/valkey
          
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
      
      volumes:
        - name: config
          configMap:
            name: valkey-config
        - name: valkey-config
          emptyDir: {}
        - name: valkey-secret
          secret:
            secretName: valkey-auth
  
  volumeClaimTemplates:
    - metadata:
        name: data
        labels:
          app.kubernetes.io/name: valkey
          app.kubernetes.io/component: database
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 10Gi  # CHANGE THIS: Adjust based on expected data size
        # storageClassName: ""  # UNCOMMENT AND SET: Use specific storage class if needed