apiVersion: apps/v1
kind: Deployment
metadata:
  name: mtls-ambassador-deployment
  labels:
    app: mtls-ambassador
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mtls-ambassador
  template:
    metadata:
      labels:
        app: mtls-ambassador
    spec:
      containers:
      - name: mtls-ambassador
        image: registry.mender.io/mendersoftware/mtls-ambassador:1.0.2
        env:
        # kubectl create secret generic mender-creds --from-literal=username='...' --from-literal=password='...'
          - name: MTLS_MENDER_USER
            valueFrom:
              secretKeyRef:
                name: mender-creds
                key: username
          - name: MTLS_MENDER_PASS
            valueFrom:
              secretKeyRef:
                name: mender-creds
                key: password
        ports:
          - containerPort: 8080
        volumeMounts:
          - name: tenant-pem
            mountPath: "/etc/mtls/certs/tenant-ca"
            readOnly: true
          - name: server-cert
            mountPath: "/etc/mtls/certs/server"
            readOnly: true
      volumes:
        - name: tenant-pem
          secret:
             # kubectl create secret generic mtls-tenant-ca-pem --from-file certs/tenant-ca/tenant.ca.pem
             secretName: mtls-tenant-ca-pem
        - name: server-cert
          secret:
             # kubectl create secret generic mtls-server-cert --from-file=certs/server/server.crt --from-file=certs/server/server.ke
             secretName: mtls-server-cert
