Replace compose runtime with scoped kind deployment

deploy/kubernetes/nuthatch.yaml.in

@@ -0,0 +1,81 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nuthatch-@@LANE@@
+  namespace: nuthatch-testbed
+data:
+  NUTHATCH_LISTEN: 0.0.0.0:8080
+  NUTHATCH_PUBLIC_BASE_URL: http://nuthatch-@@LANE@@:8080
+  NUTHATCH_REDIS_URL: "@@REDIS_URL@@"
+  NUTHATCH_S3_ENDPOINT: "@@S3_ENDPOINT@@"
+  NUTHATCH_S3_REGION: "@@S3_REGION@@"
+  NUTHATCH_S3_BUCKET: "@@S3_BUCKET@@"
+  NUTHATCH_S3_PATH_STYLE: "true"
+  NUTHATCH_AUTH_MODE: dev
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nuthatch-@@LANE@@
+  namespace: nuthatch-testbed
+type: Opaque
+stringData:
+  NUTHATCH_JWT_SECRET: synthetic-kind-jwt-secret-@@LANE@@
+  NUTHATCH_PG_CONN: "@@PG_CONN@@"
+  NUTHATCH_S3_ACCESS_KEY: "@@S3_ACCESS_KEY@@"
+  NUTHATCH_S3_SECRET_KEY: "@@S3_SECRET_KEY@@"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nuthatch-@@LANE@@
+  namespace: nuthatch-testbed
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: nuthatch-@@LANE@@}
+  template:
+    metadata:
+      labels: {app: nuthatch-@@LANE@@}
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        seccompProfile: {type: RuntimeDefault}
+      containers:
+        - name: nuthatch
+          image: @@APP_IMAGE@@
+          imagePullPolicy: Never
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities: {drop: ["ALL"]}
+          envFrom:
+            - configMapRef: {name: nuthatch-@@LANE@@}
+            - secretRef: {name: nuthatch-@@LANE@@}
+          ports:
+            - {name: http, containerPort: 8080}
+          livenessProbe:
+            httpGet: {path: /healthz, port: http}
+            periodSeconds: 2
+            failureThreshold: 15
+          readinessProbe:
+            httpGet: {path: /readyz, port: http}
+            periodSeconds: 2
+            failureThreshold: 30
+          resources:
+            requests: {cpu: 100m, memory: 96Mi}
+            limits: {cpu: "2", memory: 512Mi}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nuthatch-@@LANE@@
+  namespace: nuthatch-testbed
+spec:
+  selector: {app: nuthatch-@@LANE@@}
+  ports:
+    - {name: http, port: 8080, targetPort: http}