apiVersion: apps/v1
kind: Deployment
metadata:
  name: stalwart-controller
  namespace: stalwart
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 0
  template:
    spec:
      topologySpreadConstraints:
        - maxSkew: 1
          minDomains: 2
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: stalwart-controller
              app.kubernetes.io/instance: stalwart
      containers:
        - name: controller
          args:
            - --dsn-file
            - /run/database/dsn
            - --plan
            - /desired/plan.json
            - --secret-root
            - /run/control
            - --stalwart-url
            - http://stalwart-admin.stalwart.svc.cluster.local:8080
            - --certificate-san
            - mail.quorate.dev
            - --oidc-issuer-file
            - /run/control/oidc_issuer_url
            - --oidc-audience-file
            - /run/control/oidc_audience
            - --oidc-client-id-file
            - /run/control/oidc_client_id
            - --oidc-client-secret-file
            - /run/control/oidc_client_secret
            - --app-passwords
            - /desired/app-passwords.json
            - --vault-address
            - https://vault.vault.svc.cluster.local:8200
            - --vault-role
            - stalwart-cred-writer
            - --vault-token-file
            - /run/vault/token
            - --vault-ca-cert-file
            - /run/control/internal_ca_cert
            - --status-address
            - 0.0.0.0:9090
            - --interval
            - 5m
            - --initial-backoff
            - 5s
            - --max-backoff
            - 5m
            - --reconcile-timeout
            - 2m
            - --persistent-failure-after
            - "5"
            - --standby-ready
          volumeMounts:
            - name: control
              mountPath: /run/control
              readOnly: true
            - name: vault-token
              mountPath: /run/vault
              readOnly: true
      volumes:
        - name: control
          projected:
            defaultMode: 0440
            sources:
              - secret:
                  name: stalwart-oidc
                  items:
                    - key: audience
                      path: oidc_audience
                    - key: client_id
                      path: oidc_client_id
                    - key: client_secret
                      path: oidc_client_secret
                    - key: controller_subject
                      path: oidc_controller_subject
                    - key: human_admin_subject
                      path: oidc_human_admin_subject
                    - key: issuer_url
                      path: oidc_issuer_url
                    - key: notifier_subject
                      path: oidc_notifier_subject
                    - key: notifier_client_id
                      path: notifier_client_id
                    - key: notifier_client_secret
                      path: notifier_client_secret
                    - key: sender_subject
                      path: oidc_sender_subject
                    - key: sender_client_id
                      path: sender_client_id
                    - key: sender_client_secret
                      path: sender_client_secret
                    - key: test_client_id
                      path: test_client_id
                    - key: test_client_secret
                      path: test_client_secret
                    - key: test_subject
                      path: oidc_test_subject
              - secret:
                  name: stalwart-runtime
                  items:
                    - key: dragonfly_url
                      path: dragonfly_url
                    - key: internal_ca_cert
                      path: internal_ca_cert
              - secret:
                  name: stalwart-delivery
                  items:
                    - key: relay_endpoint
                      path: relay_endpoint
                    - key: relay_username
                      path: relay_username
        - name: vault-token
          projected:
            defaultMode: 0440
            sources:
              - serviceAccountToken:
                  path: token
                  expirationSeconds: 600