apiVersion: apps/v1
kind: Deployment
metadata:
  name: authelia
  namespace: authentication-system
  labels:
    app.kubernetes.io/name: authelia
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app.kubernetes.io/name: authelia
  template:
    metadata:
      labels:
        app.kubernetes.io/name: authelia
    spec:
      containers:
        - name: authelia
          image: authelia/authelia:4.33.1
          imagePullPolicy: IfNotPresent
          resources:
            requests:
              cpu: 1m
              memory: 50Mi
          command:
            - sh
            - -c
            - authelia --config /config/configuration.yaml
          ports:
            - name: http
              protocol: TCP
              containerPort: 9091
          volumeMounts:
            - name: authelia-config
              mountPath: /config
              readOnly: true
            - name: authelia-secrets
              mountPath: /secrets
              readOnly: true
          startupProbe:
            httpGet:
              path: /api/health
              port: http
            initialDelaySeconds: 15
            timeoutSeconds: 5
            periodSeconds: 5
            successThreshold: 1
            failureThreshold: 4
          livenessProbe:
            httpGet:
              path: /api/health
              port: http
            initialDelaySeconds: 60
            timeoutSeconds: 5
            periodSeconds: 30
            successThreshold: 1
            failureThreshold: 2
          readinessProbe:
            httpGet:
              path: /api/health
              port: http
            initialDelaySeconds: 15
            timeoutSeconds: 5
            periodSeconds: 5
            successThreshold: 1
            failureThreshold: 5
          env:
            - name: AUTHELIA_JWT_SECRET_FILE
              value: /secrets/jwt
            - name: AUTHELIA_DUO_API_SECRET_KEY_FILE
              value: /secrets/duo
            - name: AUTHELIA_SESSION_SECRET_FILE
              value: /secrets/session
            - name: AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE
              value: /secrets/mariadb
            # - name: AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
              # value: /secrets/smtp
            - name: AUTHELIA_SESSION_REDIS_PASSWORD_FILE
              value: /secrets/redis
            - name: TZ
              value: ${CONFIG_TIMEZONE}
      enableServiceLinks: false
      volumes:
        - name: authelia-config
          configMap:
            name: authelia-configs
        - name: authelia-secrets
          secret:
            secretName: authelia-secrets
            items:
              - key: authelia_jwt
                path: jwt
              - key: authelia_duo
                path: duo
              - key: authelia_session
                path: session
              - key: authelia_mariadb
                path: mariadb
              - key: authelia_smtp
                path: smtp
              - key: authelia_redis
                path: redis
