apiVersion: apps/v1
kind: Deployment
metadata:
  name: mirrored-image
  namespace: mirrored-image
  labels:
    app.kubernetes.io/name: mirrored-image
    app.kubernetes.io/instance: mirrored-image
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: mirrored-image
      app.kubernetes.io/instance: mirrored-image
  template:
    metadata:
      labels:
        app.kubernetes.io/name: mirrored-image
        app.kubernetes.io/instance: mirrored-image
    spec:
      serviceAccountName: mirrored-image
      automountServiceAccountToken: true
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile: {type: RuntimeDefault}
      containers:
        - name: controller
          image: mirrored-image-controller
          args: [run]
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef: {fieldPath: metadata.namespace}
            - {name: REGISTRY, value: registry.quorate.internal}
            - {name: QUAY_API, value: https://registry.quorate.internal}
          resources:
            requests: {cpu: 20m, memory: 32Mi}
            limits: {cpu: 200m, memory: 128Mi}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: {drop: [ALL]}
            readOnlyRootFilesystem: true
          volumeMounts:
            - {name: candidates-reader, mountPath: /candidates-reader, readOnly: true}
            - {name: mirror-reader, mountPath: /mirror-reader, readOnly: true}
            - {name: registry-ca, mountPath: /registry-ca, readOnly: true}
      volumes:
        - {name: candidates-reader, secret: {secretName: candidates-reader, defaultMode: 0440}}
        - {name: mirror-reader, secret: {secretName: mirror-reader, defaultMode: 0440}}
        - {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}