apiVersion: apps/v1
kind: Deployment
metadata:
  name: frigate
  namespace: frigate
  labels:
    app.kubernetes.io/name: frigate
    app.kubernetes.io/instance: frigate
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: frigate
      app.kubernetes.io/instance: frigate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: frigate
        app.kubernetes.io/instance: frigate
    spec:
      automountServiceAccountToken: false
      runtimeClassName: nvidia
      imagePullSecrets:
        - name: quay-cluster-pull
      terminationGracePeriodSeconds: 30
      nodeSelector:
        kubernetes.io/hostname: ms2k-y520
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: model
          image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
          imagePullPolicy: IfNotPresent
          command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec, /installer/run.fsx]
          env:
            - name: SSL_CERT_FILE
              value: /certs/ca.crt
            - name: DOTNET_NOLOGO
              value: "true"
            - name: DOTNET_CLI_TELEMETRY_OPTOUT
              value: "1"
            - name: AWS_EC2_METADATA_DISABLED
              value: "true"
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              memory: 512Mi
          securityContext:
            runAsUser: 0
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: config
              mountPath: /config
            - name: installer
              mountPath: /installer
              readOnly: true
            - name: model-s3
              mountPath: /s3
              readOnly: true
            - name: model-ca
              mountPath: /certs
              readOnly: true
      containers:
        - name: frigate
          image: ghcr.io/blakeblackshear/frigate:0.18.2-tensorrt@sha256:1cafb6ebbaff0aaf275cc3f31951bcf7e29f3989f18a10ba9565091367d8736c
          imagePullPolicy: IfNotPresent
          env:
            - name: FRIGATE_RTSP_ADDRESS
              valueFrom:
                secretKeyRef:
                  name: frigate-config
                  key: FRIGATE_RTSP_ADDRESS
            - name: FRIGATE_RTSP_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: frigate-config
                  key: FRIGATE_RTSP_PASSWORD
            - name: NVIDIA_VISIBLE_DEVICES
              value: all
            - name: NVIDIA_DRIVER_CAPABILITIES
              value: compute,video,utility
          ports:
            - name: web
              containerPort: 8971
              protocol: TCP
          resources:
            requests:
              cpu: 500m
              memory: 2Gi
              nvidia.com/gpu: "1"
            limits:
              memory: 8Gi
              nvidia.com/gpu: "1"
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
              add: ["CHOWN", "FOWNER", "SETGID", "SETUID"]
          startupProbe:
            tcpSocket:
              port: web
            failureThreshold: 60
            periodSeconds: 5
          readinessProbe:
            tcpSocket:
              port: web
            failureThreshold: 3
            periodSeconds: 10
            timeoutSeconds: 3
          livenessProbe:
            tcpSocket:
              port: web
            failureThreshold: 3
            periodSeconds: 30
            timeoutSeconds: 3
          volumeMounts:
            - name: config
              mountPath: /config
            - name: rendered-config
              mountPath: /config/config.yaml
              subPath: config.yaml
              readOnly: true
            - name: media
              mountPath: /media/frigate
            - name: cache
              mountPath: /tmp/cache
            - name: shm
              mountPath: /dev/shm
      volumes:
        - name: installer
          configMap:
            name: frigate-model
        - name: model-s3
          secret:
            secretName: model-s3
        - name: model-ca
          secret:
            secretName: frigate-ca
        - name: config
          persistentVolumeClaim:
            claimName: frigate-config
        - name: rendered-config
          secret:
            secretName: frigate-config
            items:
              - key: config.yaml
                path: config.yaml
        - name: media
          persistentVolumeClaim:
            claimName: frigate-media
        - name: cache
          emptyDir:
            medium: Memory
            sizeLimit: 1Gi
        - name: shm
          emptyDir:
            medium: Memory
            sizeLimit: 512Mi