apiVersion: apps/v1
kind: Deployment
metadata:
  name: oci-l4-relay
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: oci-l4-relay
  template:
    metadata:
      labels:
        app.kubernetes.io/name: oci-l4-relay
    spec:
      serviceAccountName: oci-l4-relay
      automountServiceAccountToken: true
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: oci-l4-relay
              topologyKey: kubernetes.io/hostname
      priorityClassName: system-node-critical
      terminationGracePeriodSeconds: 35
      containers:
        - name: relay-agent
          image: registry.quorate.internal/quorate/oci-l4-relay-agent@sha256:c5d82adbde80a5a3c3e3ecbbc5aebf53d449474cbcfc2e7a7988576edf068dfc
          imagePullPolicy: IfNotPresent
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_UID
              valueFrom:
                fieldRef:
                  fieldPath: metadata.uid
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: POD_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: RELAY_TUNNEL_ADDRESS
              value: 10.153.238.225/30
            - name: RELAY_TARGETS
              value: '[{"address":"10.104.40.127","ports":[80,443]}]'
            - name: RELAY_MAIL_UPSTREAM
              value: stalwart-relay.stalwart.svc.cluster.local
            - name: RELAY_LOCAL_RETURN_CIDRS
              value: 10.63.81.107/24,10.162.8.60/24
            - name: RELAY_METRICS_LISTEN_ADDRESS
              value: :19100
            - name: OCI_RELAY_METRICS_URL
              value: http://10.40.68.115:19100/metrics
            - name: OCI_RELAY_ENDPOINT_IP
              valueFrom:
                secretKeyRef:
                  name: oci-l4-relay-oci-wireguard
                  key: endpoint_ip
            - name: OCI_RELAY_LISTEN_PORT
              valueFrom:
                secretKeyRef:
                  name: oci-l4-relay-oci-wireguard
                  key: listen_port
            - name: OCI_RELAY_PUBLIC_KEY
              valueFrom:
                secretKeyRef:
                  name: oci-l4-relay-oci-wireguard
                  key: public_key
          ports:
            - name: metrics
              containerPort: 19100
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
              add:
                - NET_ADMIN
                - NET_BIND_SERVICE
            readOnlyRootFilesystem: true
            runAsNonRoot: false
            runAsUser: 0
            seccompProfile:
              type: RuntimeDefault
          readinessProbe:
            exec:
              command:
                - /oci-l4-relay-agent
                - health
            initialDelaySeconds: 5
            periodSeconds: 5
            failureThreshold: 3
          livenessProbe:
            exec:
              command:
                - /oci-l4-relay-agent
                - health
            initialDelaySeconds: 15
            periodSeconds: 10
            failureThreshold: 3
          resources:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              memory: 128Mi
          volumeMounts:
            - name: home-wireguard
              mountPath: /run/secrets/wireguard
              readOnly: true
            - name: runtime
              mountPath: /run/relay-agent
      volumes:
        - name: home-wireguard
          secret:
            secretName: oci-l4-relay-home-wireguard
            defaultMode: 0400
        - name: runtime
          emptyDir:
            medium: Memory
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: oci-l4-relay
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: oci-l4-relay