apiVersion: apps/v1
kind: Deployment
metadata:
  name: controller
  namespace: short
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: controller
  template:
    metadata:
      labels:
        app.kubernetes.io/name: controller
        app.kubernetes.io/instance: short
    spec:
      serviceAccountName: short-controller
      imagePullSecrets:
      - name: pull
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - topologyKey: kubernetes.io/hostname
            labelSelector:
              matchLabels:
                app.kubernetes.io/name: controller
                app.kubernetes.io/instance: short
      containers:
      - name: controller
        image: short-image
        args:
        - controller
        env:
        - name: POD_UID
          valueFrom:
            fieldRef:
              fieldPath: metadata.uid
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: VAULT_ADDR
          value: https://vault.vault.svc.cluster.local:8200
        - name: OPNSENSE_URL
          value: https://10.212.111.120:8443
        - name: SSL_CERT_FILE
          value: /ca/ca.crt
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL
        resources:
          requests:
            cpu: 50m
            memory: 64Mi
          limits:
            memory: 192Mi
        volumeMounts:
        - name: config
          mountPath: /config
          readOnly: true
        - name: ca
          mountPath: /ca
          readOnly: true
      volumes:
      - name: ca
        secret:
          secretName: ca
      - name: config
        projected:
          defaultMode: 288
          sources:
          - secret:
              name: api
              items:
              - key: private_key
                path: private_key
          - secret:
              name: cloud
              items:
              - key: config
                path: cloud.json
          - secret:
              name: opnsense
              items:
              - key: key
                path: opnsense/key
              - key: secret
                path: opnsense/secret
          - secret:
              name: ca-opnsense
              items:
              - key: ca.crt
                path: opnsense/ca.crt
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: controller
  namespace: short
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: controller