apiVersion: apps/v1
kind: Deployment
metadata:
  name: layshaft
  namespace: layshaft
spec:
  replicas: 2
  selector:
    matchLabels: &labels
      app.kubernetes.io/name: layshaft
      app.kubernetes.io/instance: layshaft
  template:
    metadata:
      labels: *labels
    spec:
      serviceAccountName: layshaft
      automountServiceAccountToken: false
      imagePullSecrets:
        - name: quay-cluster-pull
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels: *labels
              topologyKey: kubernetes.io/hostname
      dnsConfig:
        options:
          - name: ndots
            value: "1"
      initContainers:
        - name: seed
          image: &image registry.quorate.internal/quorate/layshaft@sha256:a35a0d0ef907fa1e15b586e65da9c6bc7daf923ad7507b79f6dc6a0745e23d16
          args: [seed]
          envFrom: &settings
            - configMapRef:
                name: settings
          resources: &resources
            requests: {cpu: 100m, memory: 64Mi}
            limits: {memory: 256Mi}
          securityContext: &restricted
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: [ALL]}
          volumeMounts:
            - &kube-ca {name: kube-ca, mountPath: /ca/kube, readOnly: true}
            - &vault-ca {name: vault-ca, mountPath: /ca/vault, readOnly: true}
            - &vault-auth {name: vault-auth, mountPath: /auth/vault, readOnly: true}
      containers:
        - name: server
          image: *image
          args: [serve]
          envFrom: *settings
          resources: *resources
          securityContext: *restricted
          ports:
            - {name: tls, containerPort: 8443}
          readinessProbe:
            tcpSocket: {port: tls}
          volumeMounts:
            - *kube-ca
            - *vault-ca
            - *vault-auth
            - {name: kube-auth, mountPath: /auth/kube, readOnly: true}
      volumes:
        - name: kube-ca
          configMap:
            name: kube-root-ca.crt
        - name: vault-ca
          secret:
            secretName: vault-ca
            defaultMode: 0440
        - name: kube-auth
          projected:
            defaultMode: 0440
            sources:
              - serviceAccountToken:
                  path: token
                  expirationSeconds: 1800
        - name: vault-auth
          projected:
            defaultMode: 0440
            sources:
              - serviceAccountToken:
                  path: token
                  audience: layshaft-vault
                  expirationSeconds: 1800
---
apiVersion: v1
kind: Service
metadata:
  name: layshaft
  namespace: layshaft
  labels:
    io.cilium/bgp-announce: "true"
  annotations:
    lbipam.cilium.io/ips: "10.232.82.173"
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  loadBalancerSourceRanges:
    - 10.115.187.218/24
    - 10.140.110.30/24
    - 10.186.160.23/24
    - 10.63.81.107/24
    - 10.162.8.60/24
  selector:
    app.kubernetes.io/name: layshaft
    app.kubernetes.io/instance: layshaft
  ports:
    - name: tls
      port: 443
      targetPort: tls
      protocol: TCP
      appProtocol: https
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: layshaft
  namespace: layshaft
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: layshaft
      app.kubernetes.io/instance: layshaft