apiVersion: apps/v1
kind: Deployment
metadata: {name: canary, namespace: short}
spec:
  replicas: 2
  selector:
    matchLabels: {app.kubernetes.io/name: short-canary}
  template:
    metadata:
      labels: {app.kubernetes.io/name: short-canary, app.kubernetes.io/instance: short}
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 101
        runAsGroup: 101
        seccompProfile: {type: RuntimeDefault}
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - topologyKey: kubernetes.io/hostname
              labelSelector:
                matchLabels: {app.kubernetes.io/name: short-canary, app.kubernetes.io/instance: short}
      containers:
        - name: nginx
          image: docker.io/nginx/nginx-unprivileged@sha256:2daef144b574804198caccc4041819fa1801ecd5df2252a39646bfa2b1ff3bea
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: [ALL]}
          resources:
            requests: {cpu: 25m, memory: 16Mi}
            limits: {memory: 64Mi}
          ports: [{name: http, containerPort: 8080}]
          readinessProbe:
            httpGet: {path: /, port: http}
          volumeMounts:
            - {name: temp, mountPath: /tmp}
            - {name: nginx, mountPath: /etc/nginx/nginx.conf, subPath: nginx.conf, readOnly: true}
      volumes:
        - {name: temp, emptyDir: {}}
        - {name: nginx, configMap: {name: nginx}}
---
apiVersion: v1
kind: Service
metadata: {name: canary, namespace: short}
spec:
  selector: {app.kubernetes.io/name: short-canary}
  ports: [{name: http, port: 80, targetPort: http}]