From 0f34b931274901f2ce013ec993f87180689a2980 Mon Sep 17 00:00:00 2001
From: "Eunice(Eunyoung) Shin" <eunice.shin54@gmail.com>
Date: Thu, 2 Jul 2026 23:40:57 +0900
Subject: [PATCH 1/2] fix(cicd): add db-seed init container to backend
 deployments

---
 k8s/apps/backend/overlays/dev/deployment.yaml | 14 +++++++++++++
 .../overlays/prod/deployment-blue.yaml        | 14 +++++++++++++
 .../overlays/prod/deployment-green.yaml       | 14 +++++++++++++
 .../overlays/prod/patch-deployment.yaml       | 20 +++++++++++++++++++
 4 files changed, 62 insertions(+)

diff --git a/k8s/apps/backend/overlays/dev/deployment.yaml b/k8s/apps/backend/overlays/dev/deployment.yaml
index 99be791a..e1f52241 100644
--- a/k8s/apps/backend/overlays/dev/deployment.yaml
+++ b/k8s/apps/backend/overlays/dev/deployment.yaml
@@ -45,6 +45,20 @@ spec:
             secretKeyRef:
               name: backend-api-secret
               key: DB_PASSWORD
+      - name: db-seed
+        image: "utterai-backend:dev-placeholder"
+        command:
+        - python
+        - scripts/seed_ontology.py
+        envFrom:
+        - configMapRef:
+            name: utterai-api-config
+        env:
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: backend-api-secret
+              key: DB_PASSWORD
       containers:
       - name: api
         image: "utterai-backend:dev-placeholder"
diff --git a/k8s/apps/backend/overlays/prod/deployment-blue.yaml b/k8s/apps/backend/overlays/prod/deployment-blue.yaml
index 2b900743..3560b095 100644
--- a/k8s/apps/backend/overlays/prod/deployment-blue.yaml
+++ b/k8s/apps/backend/overlays/prod/deployment-blue.yaml
@@ -62,6 +62,20 @@ spec:
             secretKeyRef:
               name: backend-api-secret
               key: DB_PASSWORD
+      - name: db-seed
+        image: utterai-backend-blue:prod-placeholder
+        command:
+        - python
+        - scripts/seed_ontology.py
+        envFrom:
+        - configMapRef:
+            name: utterai-api-config
+        env:
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: backend-api-secret
+              key: DB_PASSWORD
       containers:
       - name: api
         image: utterai-backend-blue:prod-placeholder
diff --git a/k8s/apps/backend/overlays/prod/deployment-green.yaml b/k8s/apps/backend/overlays/prod/deployment-green.yaml
index fc71d937..e4e2d406 100644
--- a/k8s/apps/backend/overlays/prod/deployment-green.yaml
+++ b/k8s/apps/backend/overlays/prod/deployment-green.yaml
@@ -62,6 +62,20 @@ spec:
             secretKeyRef:
               name: backend-api-secret
               key: DB_PASSWORD
+      - name: db-seed
+        image: utterai-backend-green:prod-placeholder
+        command:
+        - python
+        - scripts/seed_ontology.py
+        envFrom:
+        - configMapRef:
+            name: utterai-api-config
+        env:
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: backend-api-secret
+              key: DB_PASSWORD
       containers:
       - name: api
         image: utterai-backend-green:prod-placeholder
diff --git a/k8s/apps/backend/overlays/prod/patch-deployment.yaml b/k8s/apps/backend/overlays/prod/patch-deployment.yaml
index 6f9cbf12..7f22fe75 100644
--- a/k8s/apps/backend/overlays/prod/patch-deployment.yaml
+++ b/k8s/apps/backend/overlays/prod/patch-deployment.yaml
@@ -29,6 +29,16 @@ spec:
         volumeMounts:
         - name: tmp
           mountPath: "/tmp"
+      - name: db-seed
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - name: tmp
+          mountPath: "/tmp"
       containers:
       - name: api
         securityContext:
@@ -71,6 +81,16 @@ spec:
         volumeMounts:
         - name: tmp
           mountPath: "/tmp"
+      - name: db-seed
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - name: tmp
+          mountPath: "/tmp"
       containers:
       - name: api
         securityContext:

From 5fc1eebf9cefd909680a5ca80ec9a372608295cb Mon Sep 17 00:00:00 2001
From: "Eunice(Eunyoung) Shin" <eunice.shin54@gmail.com>
Date: Thu, 2 Jul 2026 23:42:52 +0900
Subject: [PATCH 2/2] chore(hpa): lower AI service prod minReplicas to 1

---
 k8s/apps/ai-service/overlays/prod/hpa.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/k8s/apps/ai-service/overlays/prod/hpa.yaml b/k8s/apps/ai-service/overlays/prod/hpa.yaml
index 0a52febb..bea87c10 100644
--- a/k8s/apps/ai-service/overlays/prod/hpa.yaml
+++ b/k8s/apps/ai-service/overlays/prod/hpa.yaml
@@ -8,7 +8,7 @@ spec:
     apiVersion: apps/v1
     kind: Deployment
     name: utterai-ai-service
-  minReplicas: 2
+  minReplicas: 1
   maxReplicas: 6
   metrics:
     - type: Resource