# The poller: claims sessions from the environment's work queue and hands each
# one to a warm sandbox. It runs first-party code and no tool calls, so it is an
# ordinary pod. It holds the environment key only (on Claude Platform on AWS, a
# Pod Identity role instead).
apiVersion: apps/v1
kind: Deployment
metadata:
  name: claude-poller
spec:
  replicas: 1
  selector:
    matchLabels:
      app: claude-poller
  template:
    metadata:
      labels:
        app: claude-poller
    spec:
      serviceAccountName: claude-poller
      enableServiceLinks: false   # keeps injected <SERVICE>_* names out of the guard's way
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: poller
          image: <ACCOUNT_ID>.dkr.ecr.<AWS_REGION>.amazonaws.com/claude-sandbox-worker:v1
          imagePullPolicy: IfNotPresent
          args: ["poll"]
          env:
            - name: ANTHROPIC_ENVIRONMENT_KEY
              valueFrom:
                secretKeyRef:
                  name: anthropic-env-key
                  key: ANTHROPIC_ENVIRONMENT_KEY
                  optional: true   # Claude Platform on AWS has no environment key
            - name: ANTHROPIC_ENVIRONMENT_ID
              valueFrom:
                configMapKeyRef:
                  name: anthropic-env
                  key: ANTHROPIC_ENVIRONMENT_ID
            # Claude Platform on AWS only. Each is set when the anthropic-env
            # ConfigMap has the key, and left out when it does not.
            - name: ANTHROPIC_PLATFORM
              valueFrom:
                configMapKeyRef: { name: anthropic-env, key: ANTHROPIC_PLATFORM, optional: true }
            - name: ANTHROPIC_AWS_WORKSPACE_ID
              valueFrom:
                configMapKeyRef: { name: anthropic-env, key: ANTHROPIC_AWS_WORKSPACE_ID, optional: true }
            - name: AWS_REGION
              valueFrom:
                configMapKeyRef: { name: anthropic-env, key: AWS_REGION, optional: true }
            - name: SANDBOX_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: SANDBOX_WARMPOOL
              value: claude-sandbox-worker
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]