tasks/k8s/deployment.yaml

# Hanzo Tasks — native ZAP daemon. One Go binary, embedded UI.
# Routing: tasks.hanzo.ai (UI + REST) / tasks-zap.hanzo.ai (ZAP) — see ingress.yaml.
# Auth: hanzo.id IAM JWT, validated upstream by hanzoai/gateway.

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tasks
  namespace: hanzo
  labels:
    app: tasks
    app.kubernetes.io/name: tasks
    app.kubernetes.io/part-of: hanzo-platform
    app.kubernetes.io/managed-by: hanzo-universe
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: tasks
  template:
    metadata:
      labels:
        app: tasks
        app.kubernetes.io/name: tasks
        app.kubernetes.io/part-of: hanzo-platform
        app.kubernetes.io/managed-by: hanzo-universe
    spec:
      imagePullSecrets:
        - name: ghcr-secret
      containers:
        - name: tasks
          image: ghcr.io/hanzoai/tasks:v3.3.1
          imagePullPolicy: IfNotPresent
          args:
            - --zap-port=9999
            - --http=:7243
            - --data=/data
            - --namespace=$(TASKS_NAMESPACE)
          ports:
            - containerPort: 9999
              name: zap
            - containerPort: 7243
              name: http
          env:
            - name: TASKS_NAMESPACE
              value: hanzo
            # Trust X-Org-Id/X-User-Id/X-User-Email from hanzoai/gateway
            # only. Gateway strips client-supplied identity headers before
            # forwarding (see global CLAUDE.md HTTP header convention).
            - name: TASKSD_REQUIRE_IDENTITY
              value: "true"
            - name: OTEL_EXPORTER_OTLP_ENDPOINT
              value: http://otel-collector.hanzo.svc:4318
            - name: OTEL_SERVICE_NAME
              value: tasks
            - name: LOG_LEVEL
              value: info
          volumeMounts:
            - name: data
              mountPath: /data
          startupProbe:
            httpGet: { path: /healthz, port: 7243 }
            initialDelaySeconds: 2
            periodSeconds: 2
            failureThreshold: 30
          readinessProbe:
            httpGet: { path: /healthz, port: 7243 }
            periodSeconds: 5
            failureThreshold: 3
          livenessProbe:
            httpGet: { path: /healthz, port: 7243 }
            initialDelaySeconds: 30
            periodSeconds: 30
            failureThreshold: 5
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: "1"
              memory: 512Mi
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: tasks-data

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: tasks-data
  namespace: hanzo
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 10Gi

---
apiVersion: v1
kind: Service
metadata:
  name: tasks
  namespace: hanzo
spec:
  selector:
    app: tasks
  ports:
    - name: http
      port: 80
      targetPort: 7243
    - name: zap
      port: 9999
      targetPort: 9999