# Exercise 1: A production-ready Pod spec (easy)
#
# Validate: kubectl apply --dry-run=server -f this-file.yaml   (needs a cluster, e.g. kind)
# Then:     kubectl apply -f this-file.yaml && kubectl get pod notes -w
#
# Complete the Pod `notes` (image nginxinc/nginx-unprivileged:1.27, listens on 8080):
#   TODO 1: labels app=notes, tier=web
#   TODO 2: requests cpu 100m / memory 64Mi, memory limit 128Mi
#   TODO 3: readinessProbe HTTP GET / on port 8080 every 5 s
#   TODO 4: livenessProbe HTTP GET / on port 8080, initial delay 10 s, every 10 s, 3 failures
#   TODO 5: securityContext — non-root, no privilege escalation, drop ALL capabilities,
#           read-only root filesystem (mount emptyDir volumes at /tmp and /var/cache/nginx)
#   TODO 6: an init container (busybox:1.36) that writes "hello from init" to
#           /work/index.html in a shared emptyDir, served by nginx from
#           /usr/share/nginx/html
#
# CHECKLIST:
# [ ] Pod reaches Running and Ready (1/1).
# [ ] kubectl exec notes -- id   shows a non-root uid.
# [ ] kubectl port-forward pod/notes 8080 && curl localhost:8080 → "hello from init".
# [ ] kubectl get pod notes -o jsonpath='{.status.qosClass}' → Burstable.
# [ ] Writing to / inside the container fails (read-only filesystem).
apiVersion: v1
kind: Pod
metadata:
  name: notes
  # TODO 1: labels
spec:
  # TODO 6: initContainers
  containers:
    - name: web
      image: nginxinc/nginx-unprivileged:1.27
      ports:
        - containerPort: 8080
          name: http
      # TODO 2: resources
      # TODO 3: readinessProbe
      # TODO 4: livenessProbe
      # TODO 5: securityContext + volumeMounts
  volumes: []
    # TODO: emptyDir volumes for html, tmp, cache