apiVersion: apps/v1
kind: Deployment
metadata:
  name: oci-l4-relay-wan-controller
  namespace: kube-system
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app.kubernetes.io/name: oci-l4-relay-wan-controller
  template:
    metadata:
      labels:
        app.kubernetes.io/name: oci-l4-relay-wan-controller
    spec:
      serviceAccountName: oci-l4-relay-wan-controller
      automountServiceAccountToken: true
      securityContext:
        fsGroup: 65532
        fsGroupChangePolicy: OnRootMismatch
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: oci-l4-relay-wan-controller
              topologyKey: kubernetes.io/hostname
      containers:
        - name: controller
          image: registry.quorate.internal/quorate/oci-l4-relay-wan-controller@sha256:395e68f424e6fddcfb72cee8f83887ed219b47e16cd87562c4073325b3598803
          imagePullPolicy: IfNotPresent
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: OPNSENSE_URL
              value: https://10.212.111.120:8443
            - name: OPNSENSE_INTERFACE
              value: WAN
            - name: POLL_INTERVAL
              value: 10s
            - name: MINIMUM_OBSERVATIONS
              value: "2"
            - name: WIREGUARD_PORT
              value: "51820"
            - name: OPNSENSE_KEY_PATH
              value: /run/secrets/opnsense/key
            - name: OPNSENSE_SECRET_PATH
              value: /run/secrets/opnsense/secret
            - name: OPNSENSE_CA_PATH
              value: /run/secrets/opnsense-ca/ca.crt
            - name: OCI_TENANCY_OCID_PATH
              value: /run/secrets/oci/tenancy_ocid
            - name: OCI_USER_OCID_PATH
              value: /run/secrets/oci/user_ocid
            - name: OCI_FINGERPRINT_PATH
              value: /run/secrets/oci/fingerprint
            - name: OCI_PRIVATE_KEY_PATH
              value: /run/secrets/oci/private_key
            - name: OCI_REGION_PATH
              value: /run/secrets/oci/region
            - name: OCI_NSG_OCID_PATH
              value: /run/secrets/oci/network_security_group_id
            - name: OCI_SECURITY_RULE_ID_PATH
              value: /run/secrets/oci/security_rule_id
            - name: WG_STATUS_URL
              value: http://oci-l4-relay-metrics.kube-system.svc.cluster.local:19100/metrics
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 65532
            seccompProfile:
              type: RuntimeDefault
          resources:
            requests:
              cpu: 4m
              memory: 20Mi
            limits:
              memory: 128Mi
          volumeMounts:
            - name: opnsense
              mountPath: /run/secrets/opnsense
              readOnly: true
            - name: opnsense-ca
              mountPath: /run/secrets/opnsense-ca
              readOnly: true
            - name: oci
              mountPath: /run/secrets/oci
              readOnly: true
      volumes:
        - name: opnsense
          secret:
            secretName: opnsense-interface-watcher
            defaultMode: 0440
        - name: opnsense-ca
          secret:
            secretName: ca-opnsense
            defaultMode: 0440
        - name: oci
          secret:
            secretName: oci-l4-relay-wan-controller-api
            defaultMode: 0440