# 6.2 — Deployment, Service, NetworkPolicy (GREEN)

Phase: 6 — Deploy and cutover
Stage: GREEN
Depends on: [6.1](6.1-hardened-image.md)

Manifests only. Nothing here exposes the gateway publicly — that is the cutover, and
it is a separate step.

- [ ] A Deployment runs the gateway with at least 2 replicas, matching Kong's current replica count
- [ ] The pod spec carries the hardening from 6.1: non-root, read-only rootfs, all capabilities dropped, `seccompProfile: RuntimeDefault`
- [ ] Liveness probes hit `/healthz` and readiness probes hit `/readyz`; readiness fails while config is invalid or JWKS has never been fetched
- [ ] Route configuration is mounted from a ConfigMap sourced from git — not a CRD, and not baked into the image
- [ ] A config change rolls the pods; a stale ConfigMap cannot be silently served by a long-lived pod
- [ ] Termination allows in-flight requests to drain, with a grace period long enough for the streaming timeouts in use
- [ ] A Service exposes the gateway in-cluster with a named port, resolvable at `http://<svc>.api.svc.cluster.local`
- [ ] No ServiceAccount with any RBAC is bound; the pod does not need or receive an API-server token (G2)
- [ ] A NetworkPolicy allows ingress only from `ingress-nginx`
- [ ] The same NetworkPolicy allows egress only to the proxied upstreams plus Authentik, plus DNS. Everything else is denied
- [ ] Resource requests and limits are set explicitly
- [ ] Every manifest is committed to git and applied by Argo. No `kubectl apply`, no `helm upgrade` (G7)

## Verify

```bash
kubectl -n api get deploy homelab-frontend -o jsonpath='{.spec.replicas} {.spec.template.spec.securityContext}{"\n"}'
# expected: 2, with runAsNonRoot true and seccompProfile RuntimeDefault

kubectl -n api exec deploy/homelab-frontend -- true 2>&1
# expected: fails — distroless image has no shell to exec into

kubectl -n llm-serving run np-probe --rm -it --image=curlimages/curl --restart=Never -- \
  curl -s -m 5 http://homelab-frontend.api.svc.cluster.local/healthz
# expected: times out or is refused — ingress is restricted to ingress-nginx only
```