apiVersion: v1
kind: ConfigMap
metadata:
  name: nuthatch-@@LANE@@
  namespace: nuthatch-testbed
data:
  NUTHATCH_LISTEN: 0.0.0.0:8080
  NUTHATCH_PUBLIC_BASE_URL: https://nuthatch-@@LANE@@:8080
  NUTHATCH_REDIS_URL: "@@REDIS_URL@@"
  NUTHATCH_OIDC_ISSUER: "@@OIDC_ISSUER@@"
  NUTHATCH_OIDC_CLIENT_ID: "@@OIDC_CLIENT_ID@@"
  NUTHATCH_OIDC_ADDITIONAL_AUDIENCES: "@@OIDC_ADDITIONAL_AUDIENCES@@"
  NUTHATCH_OIDC_REDIRECT_URI: https://nuthatch-@@LANE@@:8080/oidc/callback
  NUTHATCH_S3_ENDPOINT: "@@S3_ENDPOINT@@"
  NUTHATCH_S3_REGION: "@@S3_REGION@@"
  NUTHATCH_S3_BUCKET: "@@S3_BUCKET@@"
  NUTHATCH_S3_PATH_STYLE: "true"
  NUTHATCH_IDEMPOTENCY_WINDOW_SEC: "86400"
  NUTHATCH_OBJECT_REQUEST_TIMEOUT_SEC: "300"
---
apiVersion: v1
kind: Secret
metadata:
  name: nuthatch-@@LANE@@
  namespace: nuthatch-testbed
type: Opaque
stringData:
  NUTHATCH_JWT_SECRET: synthetic-kind-session-jwt-secret-@@LANE@@
  NUTHATCH_OIDC_CLIENT_SECRET: "@@OIDC_CLIENT_SECRET@@"
  NUTHATCH_PG_CONN: "@@PG_CONN@@"
  NUTHATCH_S3_ACCESS_KEY: "@@S3_ACCESS_KEY@@"
  NUTHATCH_S3_SECRET_KEY: "@@S3_SECRET_KEY@@"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nuthatch-@@LANE@@
  namespace: nuthatch-testbed
spec:
  replicas: 1
  selector:
    matchLabels: {app: nuthatch-@@LANE@@}
  template:
    metadata:
      labels: {app: nuthatch-@@LANE@@}
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      dnsPolicy: None
      dnsConfig:
        nameservers: [10.96.0.53]
        searches:
          - nuthatch-testbed.svc.cluster.local
          - svc.cluster.local
          - cluster.local
        options:
          - {name: ndots, value: "5"}
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile: {type: RuntimeDefault}
      initContainers:
        - name: tls-certificate
          image: @@APP_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              openssl req \
                -x509 \
                -newkey rsa:2048 \
                -nodes \
                -days 1 \
                -subj "/CN=nuthatch-@@LANE@@" \
                -addext "subjectAltName=DNS:nuthatch-@@LANE@@,DNS:nuthatch-@@LANE@@.nuthatch-testbed.svc" \
                -keyout /tls/tls.key \
                -out /tls/tls.crt
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: ["ALL"]}
          volumeMounts:
            - {name: tls, mountPath: /tls}
          resources:
            requests: {cpu: 25m, memory: 16Mi}
            limits: {cpu: 250m, memory: 32Mi}
      containers:
        - name: nuthatch
          image: @@APP_IMAGE@@
          imagePullPolicy: Never
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: ["ALL"]}
          envFrom:
            - configMapRef: {name: nuthatch-@@LANE@@}
            - secretRef: {name: nuthatch-@@LANE@@}
          ports:
            - {name: https, containerPort: 8080}
          livenessProbe:
            httpGet: {path: /healthz, port: https, scheme: HTTPS}
            periodSeconds: 2
            failureThreshold: 15
          readinessProbe:
            httpGet: {path: /readyz, port: https, scheme: HTTPS}
            periodSeconds: 2
            failureThreshold: 30
          resources:
            requests: {cpu: 100m, memory: 96Mi}
            limits: {cpu: "2", memory: 512Mi}
          volumeMounts:
            - {name: tls, mountPath: /tls, readOnly: true}
      volumes:
        - name: tls
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: nuthatch-@@LANE@@
  namespace: nuthatch-testbed
spec:
  selector: {app: nuthatch-@@LANE@@}
  ports:
    - {name: https, port: 8080, targetPort: https}