apiVersion: apps/v1
kind: Deployment
metadata:
  name: stalwart-controller
  namespace: stalwart
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: stalwart-controller
      app.kubernetes.io/instance: stalwart
  template:
    metadata:
      annotations:
        quorate.internal/source-revision: 318c46b68e20be4d793a344ea1e5464e436edbaa
      labels:
        app.kubernetes.io/name: stalwart-controller
        app.kubernetes.io/instance: stalwart
        quorate.dev/zitadel-relay: "true"
    spec:
      serviceAccountName: stalwart
      automountServiceAccountToken: false
      runtimeClassName: gvisor
      securityContext:
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: controller
          image: registry.quorate.internal/quorate/stalwart-controller:delivery-318c46b68e20be4d793a344ea1e5464e436edbaa@sha256:70704960a5bf3eb8398c8f26ecaefe7341faa2e7e65c16fa3c40a8e13c94b7dd
          imagePullPolicy: IfNotPresent
          env:
            - name: HOME
              value: /tmp
          ports:
            - name: status
              containerPort: 9090
          livenessProbe:
            httpGet:
              path: /healthz
              port: status
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /readyz
              port: status
            periodSeconds: 5
          securityContext:
            runAsNonRoot: true
            runAsUser: 65532
            runAsGroup: 65532
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              cpu: 250m
              memory: 128Mi
          volumeMounts:
            - name: desired
              mountPath: /desired
              readOnly: true
            - name: database
              mountPath: /run/database
              readOnly: true
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: desired
          configMap:
            name: desired
        - name: database
          secret:
            secretName: stalwart-db
            defaultMode: 0440
        - name: tmp
          emptyDir: {}