apiVersion: apps/v1
kind: Deployment
metadata:
  name: mta-sts
  namespace: mta-sts
  labels:
    app.kubernetes.io/name: mta-sts
    app.kubernetes.io/instance: mta-sts
    app.kubernetes.io/component: static-policy
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: mta-sts
      app.kubernetes.io/instance: mta-sts
  template:
    metadata:
      labels:
        app.kubernetes.io/name: mta-sts
        app.kubernetes.io/instance: mta-sts
        app.kubernetes.io/component: static-policy
    spec:
      runtimeClassName: gvisor
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: mta-sts
                  app.kubernetes.io/instance: mta-sts
              topologyKey: kubernetes.io/hostname
      containers:
        - name: nginx
          image: cgr.dev/chainguard/nginx@sha256:0b4de0f60ae2295fdc852564d178b5473109baf9fc826fa5eb38a59f930e218e
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              memory: 64Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 1
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 15
          volumeMounts:
            - name: nginx-conf
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
              readOnly: true
            - name: tmp
              mountPath: /tmp
            - name: nginx-logs
              mountPath: /var/lib/nginx/logs
      volumes:
        - name: nginx-conf
          configMap:
            name: mta-sts
            items:
              - key: nginx.conf
                path: nginx.conf
        - name: tmp
          emptyDir: {}
        - name: nginx-logs
          emptyDir: {}