apiVersion: apps/v1
kind: Deployment
metadata:
  name: neo-tetris
  namespace: games
  labels:
    app: neo-tetris
spec:
  replicas: 2
  selector:
    matchLabels:
      app: neo-tetris
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  template:
    metadata:
      labels:
        app: neo-tetris
    spec:
      containers:
        - name: game
          # Pas dit aan naar je registry (bijv. ghcr.io/<user>/neo-tetris:latest)
          image: neo-tetris:latest
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 80
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 128Mi
          readinessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 2
            periodSeconds: 5
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
            failureThreshold: 3
          securityContext:
            # nginx-master draait als root en wisselt zelf naar de 'nginx'-user;
            # daarom geen readOnlyRootFilesystem of capabilities.drop hier.
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: false
            runAsNonRoot: false