apiVersion: apps/v1
kind: StatefulSet
metadata: { name: cobble-writer, namespace: cobble }
spec:
  serviceName: cobble-writer
  replicas: 1                      # BẤT BIẾN. Không bao giờ 2.
  podManagementPolicy: OrderedReady
  updateStrategy: { type: RollingUpdate }
  selector: { matchLabels: { app: cobble, role: writer } }
  template:
    metadata: { labels: { app: cobble, role: writer } }
    spec:
      terminationGracePeriodSeconds: 60     # để WAL kịp flush
      containers:
      - name: surreal
        image: your-registry/surreal-cobble:3.3.0
        args: ["start","--bind","0.0.0.0:8000","cobble:///data"]
        ports:
        - { name: http,   containerPort: 8000 }
        - { name: stream, containerPort: 8100 }
        - { name: peer,   containerPort: 8110 }
        envFrom:
        - configMapRef: { name: cobble-env }
        env:
        - { name: SURREAL_COBBLE_STREAM_ADDR, value: "0.0.0.0:8100" }
        - { name: SURREAL_COBBLE_PEER_ADDR,   value: "0.0.0.0:8110" }
        # Chính nó KHÔNG nằm trong danh sách. Cluster size = peers + 1.
        - { name: SURREAL_COBBLE_PEERS,
            value: "cobble-replica-0.cobble-replica.cobble.svc.cluster.local:8110,cobble-witness.cobble.svc.cluster.local:8110" }
        - { name: SURREAL_COBBLE_WAL,          value: "every" }
        # Trần đĩa nóng: không có nó, PVC phải to bằng cả dataset.
        # Offload SST nguội xuống S3 ở mức dùng 0.85, chặn ghi ở 0.95. Sàn 4 GiB.
        - { name: SURREAL_COBBLE_LOCAL_CAP_GB,   value: "20" }
        - { name: SURREAL_COBBLE_WAL_MAX_MB,     value: "1024" }   # cứng = 2x
        - { name: SURREAL_COBBLE_WAL_KEEP_MB,    value: "256" }    # đuôi cho replica backfill
        - { name: SURREAL_COBBLE_BLOCK_CACHE_MB, value: "512" }
        - { name: SURREAL_COBBLE_READ_CACHE_MB,  value: "256" }
        - { name: SURREAL_COBBLE_ACK,             value: "semi" }
        - { name: SURREAL_COBBLE_ACK_TIMEOUT_MS,  value: "5000" }
        - { name: SURREAL_USER, value: root }
        - { name: SURREAL_PASS, valueFrom: { secretKeyRef: { name: cobble-shared, key: ROOT_PASS } } }
        - { name: SURREAL_COBBLE_STREAM_SECRET,  valueFrom: { secretKeyRef: { name: cobble-shared, key: STREAM_SECRET } } }
        - { name: SURREAL_COBBLE_S3_ACCESS_KEY,  valueFrom: { secretKeyRef: { name: cobble-shared, key: S3_ACCESS_KEY } } }
        - { name: SURREAL_COBBLE_S3_SECRET_KEY,  valueFrom: { secretKeyRef: { name: cobble-shared, key: S3_SECRET_KEY } } }
        volumeMounts: [{ name: data, mountPath: /data }]
        readinessProbe: { httpGet: { path: /health, port: http }, periodSeconds: 5 }
        # KHÔNG dùng livenessProbe hung hăng: node bị fence cố ý từ chối phục vụ,
        # khởi động lại nó chỉ tạo vòng lặp restart, không sửa được gì.
        resources: { requests: { cpu: "2", memory: 4Gi } }
  volumeClaimTemplates:
  - metadata: { name: data }
    spec:
      accessModes: [ReadWriteOnce]
      resources: { requests: { storage: 40Gi } }   # >= LOCAL_CAP_GB + 2x WAL_MAX_MB + dư

apiVersion: apps/v1
kind: StatefulSet
metadata: { name: cobble-replica, namespace: cobble }
spec:
  serviceName: cobble-replica
  replicas: 2                      # muốn bao nhiêu cũng được
  selector: { matchLabels: { app: cobble, role: replica } }
  template:
    metadata: { labels: { app: cobble, role: replica } }
    spec:
      topologySpreadConstraints:   # đừng dồn hết vào một zone
      - maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: DoNotSchedule
        labelSelector: { matchLabels: { app: cobble, role: replica } }
      containers:
      - name: surreal
        image: your-registry/surreal-cobble:3.3.0
        args: ["start","--bind","0.0.0.0:8000","cobblero:///data"]
        ports:
        - { name: http, containerPort: 8000 }
        - { name: peer, containerPort: 8110 }
        envFrom: [{ configMapRef: { name: cobble-env } }]
        env:
        - { name: SURREAL_COBBLE_UPSTREAM,
            value: "cobble-writer-0.cobble-writer.cobble.svc.cluster.local:8100" }
        - { name: SURREAL_COBBLE_PEER_ADDR, value: "0.0.0.0:8110" }
        - { name: SURREAL_COBBLE_PEERS,
            value: "cobble-writer-0.cobble-writer.cobble.svc.cluster.local:8110,cobble-witness.cobble.svc.cluster.local:8110" }
        - { name: SURREAL_COBBLE_ACK,              value: "semi" }   # phải khớp node ghi
        - { name: SURREAL_COBBLE_OPLOG_KEEP_MB,    value: "4096" }
        - { name: SURREAL_COBBLE_OVERLAY_CAP_MB,   value: "512" }
        - { name: SURREAL_COBBLE_BLOCK_CACHE_MB,   value: "256" }
        - { name: SURREAL_COBBLE_READ_CACHE_MB,    value: "128" }
        - { name: SURREAL_COBBLE_REFRESH_MS,       value: "1000" }
        - { name: SURREAL_LIVE_QUERY_ENGINE,       value: "router" } # cần cho LIVE trên replica
        - { name: SURREAL_USER, value: root }
        - { name: SURREAL_PASS, valueFrom: { secretKeyRef: { name: cobble-shared, key: ROOT_PASS } } }
        - { name: SURREAL_COBBLE_STREAM_SECRET, valueFrom: { secretKeyRef: { name: cobble-shared, key: STREAM_SECRET } } }
        - { name: SURREAL_COBBLE_S3_ACCESS_KEY, valueFrom: { secretKeyRef: { name: cobble-shared, key: S3_ACCESS_KEY } } }
        - { name: SURREAL_COBBLE_S3_SECRET_KEY, valueFrom: { secretKeyRef: { name: cobble-shared, key: S3_SECRET_KEY } } }
        volumeMounts: [{ name: data, mountPath: /data }]
        readinessProbe: { httpGet: { path: /health, port: http }, periodSeconds: 5 }
  volumeClaimTemplates:
  - metadata: { name: data }
    spec:
      accessModes: [ReadWriteOnce]
      resources: { requests: { storage: 60Gi } }   # oplog + base mirror

apiVersion: apps/v1
kind: Deployment
metadata: { name: cobble-witness, namespace: cobble }
spec:
  replicas: 1
  selector: { matchLabels: { app: cobble, role: witness } }
  template:
    metadata: { labels: { app: cobble, role: witness } }
    spec:
      affinity:
        podAntiAffinity:            # KHÔNG ở chung node với writer/replica
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector: { matchExpressions: [{ key: role, operator: In, values: [writer, replica] }] }
            topologyKey: kubernetes.io/hostname
      containers:
      - name: witness
        image: your-registry/cobble-witness:3.3.0   # ~380 KB, không phụ thuộc
        args: ["/state"]
        ports: [{ name: peer, containerPort: 8110 }]
        env:
        - { name: SURREAL_COBBLE_PEER_ADDR, value: "0.0.0.0:8110" }
        - { name: SURREAL_COBBLE_PEERS,
            value: "cobble-writer-0.cobble-writer.cobble.svc.cluster.local:8110,cobble-replica-0.cobble-replica.cobble.svc.cluster.local:8110" }
        - { name: SURREAL_COBBLE_CLUSTER_ID, value: "prod" }
        - { name: SURREAL_COBBLE_STREAM_SECRET, valueFrom: { secretKeyRef: { name: cobble-shared, key: STREAM_SECRET } } }
        volumeMounts: [{ name: state, mountPath: /state }]
        resources: { requests: { cpu: 10m, memory: 32Mi } }
      volumes:
      - name: state
        persistentVolumeClaim: { claimName: cobble-witness-state }
---
# Term phải sống sót qua restart: witness quên epoch là witness cho phép
# node ghi cũ quay lại.
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: cobble-witness-state, namespace: cobble }
spec:
  accessModes: [ReadWriteOnce]
  resources: { requests: { storage: 64Mi } }

# Headless: cần tên pod ổn định cho danh sách peer và cho upstream.
apiVersion: v1
kind: Service
metadata: { name: cobble-writer, namespace: cobble }
spec:
  clusterIP: None
  selector: { app: cobble, role: writer }
  ports:
  - { name: http, port: 8000 }
  - { name: stream, port: 8100 }
  - { name: peer, port: 8110 }
---
apiVersion: v1
kind: Service
metadata: { name: cobble-replica, namespace: cobble }
spec:
  clusterIP: None
  selector: { app: cobble, role: replica }
  ports: [{ name: http, port: 8000 }, { name: peer, port: 8110 }]
---
# Endpoint client dùng để ĐỌC: cân tải qua các replica.
apiVersion: v1
kind: Service
metadata: { name: cobble-read, namespace: cobble }
spec:
  selector: { app: cobble, role: replica }
  ports: [{ name: http, port: 8000 }]
---
# Endpoint client dùng để GHI. Khi failover, chỉ cần đổi selector sang node
# được promote — client không phải cấu hình lại.
apiVersion: v1
kind: Service
metadata: { name: cobble-write, namespace: cobble }
spec:
  selector: { app: cobble, role: writer }
  ports: [{ name: http, port: 8000 }]
---
apiVersion: v1
kind: Service
metadata: { name: cobble-witness, namespace: cobble }
spec:
  selector: { app: cobble, role: witness }
  ports: [{ name: peer, port: 8110 }]
---
# Chỉ cho phép ai được nói chuyện với cổng stream/peer. Giao thức có xác thực
# challenge-response, nhưng đừng phơi cổng ra ngoài cụm.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: cobble-internal, namespace: cobble }
spec:
  podSelector: { matchLabels: { app: cobble } }
  policyTypes: [Ingress]
  ingress:
  - from: [{ podSelector: { matchLabels: { app: cobble } } }]
    ports: [{ port: 8100 }, { port: 8110 }]
  - from: [{ namespaceSelector: {} }]
    ports: [{ port: 8000 }]

# CHẠY TAY, sau khi đã rào node ghi cũ. Không đặt vào CI, không tự động hoá.
#
#   1) kubectl -n cobble scale statefulset/cobble-writer --replicas=0
#   2) đợi pod biến mất thật:  kubectl -n cobble get pod -l role=writer -w
#   3) chạy Job này (nó chạy trên PVC của replica được chọn)
apiVersion: batch/v1
kind: Job
metadata: { name: cobble-promote, namespace: cobble }
spec:
  backoffLimit: 0            # thất bại thì DỪNG, đừng thử lại mù
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: promote
        image: your-registry/surreal-cobble:3.3.0
        command: ["/scripts/cobble-ra-promote.sh", "/data", "/data/base", "--", "true"]
        env:
        - { name: SURREAL_COBBLE_FENCE_CONFIRMED, value: "1" }
        # Cụm 3 thành viên (writer + replica + witness) thì KHÔNG cần cờ dưới đây:
        # script tự thấy đa số 2/3 qua file SURREAL_COBBLE_QUORUM.
        # Cụm 2 thành viên thì luôn cần — và đó là chữ ký của con người.
        # - { name: SURREAL_COBBLE_PROMOTE_WITHOUT_QUORUM, value: "1" }
        volumeMounts: [{ name: data, mountPath: /data }]
      volumes:
      - name: data
        persistentVolumeClaim: { claimName: data-cobble-replica-0 }
---
#   4) đổi Service cobble-write sang node vừa promote (hoặc gắn nhãn lại pod)
#   5) node ghi cũ: GIỮ replicas=0 cho tới khi đã cắt đuôi WAL và cho nó
#      gia nhập lại làm replica. Nếu nó bật dậy chui, pre-vote sẽ tự poison nó.