# kubernetes/mongodb/mongodb.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: mongo-pv
spec:
  capacity:
    storage: 2Gi
  volumeMode: Filesystem
  accessModes:
  - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: local-storage
  local:
    path: /root/todoApp/kubernetes/mongodb/data

  nodeAffinity:
    required:
      nodeSelectorTerms:
      - matchExpressions:
        - key: kubernetes.io/hostname
          operator: In
          values:
          - master-controller

---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mongo
  namespace: todo-app
spec:
  serviceName: mongo-service   # ✅ REQUIRED
  replicas: 1
  selector:
    matchLabels:
      app: mongo

  volumeClaimTemplates:
  - metadata:
      name: mongo-pvc
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: local-storage
      resources:
        requests:
          storage: 2Gi
  template:
    metadata:
      labels:
        app: mongo
        tier: database        # ← label for NetworkPolicy
    spec:
      tolerations:
      - key: "node-role.kubernetes.io/control-plane"
        operator: "Exists"
        effect: "NoSchedule"
      containers:
        - name: mongo
          image: mongo
          ports:
            - containerPort: 27017
          volumeMounts:
            - name: mongo-pvc
              mountPath: /data/db
          # Security — run as non-root
          securityContext:
            runAsNonRoot: true
            runAsUser: 999
            allowPrivilegeEscalation: false
---
apiVersion: v1
kind: Service
metadata:
  name: mongo-service
  namespace: todo-app
spec:
  clusterIP: None
  selector:
    app: mongo
  ports:
    - port: 27017
      targetPort: 27017
  # ClusterIP — internal only, never exposed outside
  type: ClusterIP