apiVersion: v1
kind: ConfigMap
metadata:
  name: nuthatch-@@LANE@@
  namespace: nuthatch-testbed
data:
  NUTHATCH_LISTEN: 0.0.0.0:8080
  NUTHATCH_PUBLIC_BASE_URL: http://nuthatch-@@LANE@@:8080
  NUTHATCH_REDIS_URL: "@@REDIS_URL@@"
  NUTHATCH_S3_ENDPOINT: "@@S3_ENDPOINT@@"
  NUTHATCH_S3_REGION: "@@S3_REGION@@"
  NUTHATCH_S3_BUCKET: "@@S3_BUCKET@@"
  NUTHATCH_S3_PATH_STYLE: "true"
  NUTHATCH_AUTH_MODE: dev
---
apiVersion: v1
kind: Secret
metadata:
  name: nuthatch-@@LANE@@
  namespace: nuthatch-testbed
type: Opaque
stringData:
  NUTHATCH_JWT_SECRET: synthetic-kind-jwt-secret-@@LANE@@
  NUTHATCH_PG_CONN: "@@PG_CONN@@"
  NUTHATCH_S3_ACCESS_KEY: "@@S3_ACCESS_KEY@@"
  NUTHATCH_S3_SECRET_KEY: "@@S3_SECRET_KEY@@"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nuthatch-@@LANE@@
  namespace: nuthatch-testbed
spec:
  replicas: 1
  selector:
    matchLabels: {app: nuthatch-@@LANE@@}
  template:
    metadata:
      labels: {app: nuthatch-@@LANE@@}
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        seccompProfile: {type: RuntimeDefault}
      containers:
        - name: nuthatch
          image: @@APP_IMAGE@@
          imagePullPolicy: Never
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: ["ALL"]}
          envFrom:
            - configMapRef: {name: nuthatch-@@LANE@@}
            - secretRef: {name: nuthatch-@@LANE@@}
          ports:
            - {name: http, containerPort: 8080}
          livenessProbe:
            httpGet: {path: /healthz, port: http}
            periodSeconds: 2
            failureThreshold: 15
          readinessProbe:
            httpGet: {path: /readyz, port: http}
            periodSeconds: 2
            failureThreshold: 30
          resources:
            requests: {cpu: 100m, memory: 96Mi}
            limits: {cpu: "2", memory: 512Mi}
---
apiVersion: v1
kind: Service
metadata:
  name: nuthatch-@@LANE@@
  namespace: nuthatch-testbed
spec:
  selector: {app: nuthatch-@@LANE@@}
  ports:
    - {name: http, port: 8080, targetPort: http}