# REVIEW ONLY: not referenced by k8s/gitops/kustomization.yaml.
# Replace the explicit image placeholder only after image evidence is accepted.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: actcore-worker
  namespace: activity-core
spec:
  template:
    spec:
      containers:
        - name: worker
          image: forgejo.coulomb.social/coulomb/activity-core@sha256:REQUIRES_REVIEWED_IMAGE_DIGEST
          env:
            - name: ACTIVITY_CORE_CUSTODIAN_ROOT
              value: /opt/custodian-commands
            - name: ACTIVITY_CORE_CUSTODIAN_FLEET_ROOT
              value: /var/lib/custodian-inputs/snapshots
            - name: ACTIVITY_CORE_CUSTODIAN_STATE_ROOT
              value: /var/lib/activity-core/custodian
            - name: ACTIVITY_CORE_CUSTODIAN_REPOS
              value: the-custodian,net-kingdom,railiance-platform,activity-core,access-engine,secrets-engine,ops-mason,ops-warden,key-cape,user-engine,tenant-engine,gate-house,kings-guard,policy-nexus,rapp-policy-nexus
            - name: ACTIVITY_CORE_CUSTODIAN_HUB
              value: http://state-hub.state-hub.svc.cluster.local:8000
            - name: ACTIVITY_CORE_CUSTODIAN_INPUT_POLICY
              value: /opt/custodian-input-policy.json
            - name: ACTIVITY_CORE_CUSTODIAN_SNAPSHOT_DESCRIPTOR
              value: /var/lib/activity-core/custodian/inputs/current.json
            - name: ACTIVITY_CORE_CUSTODIAN_ALLOCATION_REQUEST
              value: /var/lib/activity-core/custodian/requests/current.json
          volumeMounts:
            - name: ops-artefacts
              mountPath: /var/lib/activity-core/custodian
              subPath: custodian/state
            - name: ops-artefacts
              mountPath: /var/lib/custodian-inputs/snapshots
              subPath: custodian/snapshots
              readOnly: true
# Existing ops-artefacts volume/claim, UID1000 and resources are preserved.
# Owner precreates only these private subdirectories; no whole-claim chmod/chown.