apiVersion: apps/v1
kind: Deployment
metadata:
  name: opademo
  labels:
    app: opademo
spec:
  replicas: 3
  selector:
    matchLabels:
      app: opademo
  template:
    metadata:
      labels:
        app: opademo
      name: opademo
    spec:
      containers:
        - name: webapp
          image: parameswaranvv/opa-web-demo:latest
          ports:
            - name: http
              containerPort: 8080
          env:
            - name: opa.auth.url
              value: http://localhost:8181/v1/data/opaweb/authz/allow
        - name: opa
          image: openpolicyagent/opa:latest
          ports:
            - name: http
              containerPort: 8181
          args:
            - "run"
            - "--log-level"
            - "debug"
            - "--ignore=.*"  # exclude hidden dirs created by Kubernetes
            - "--server"
            - "/policies"
          volumeMounts:
            - readOnly: true
              mountPath: /policies
              name: opademo-policy
          livenessProbe:
            httpGet:
              scheme: HTTP              # assumes OPA listens on localhost:8181
              port: 8181
            initialDelaySeconds: 5      # tune these periods for your environemnt
            periodSeconds: 5
          readinessProbe:
              httpGet:
                path: /health?bundle=true  # Include bundle activation in readiness
                scheme: HTTP
                port: 8181
              initialDelaySeconds: 5
              periodSeconds: 5
      volumes:
        - name: opademo-policy
          configMap:
            name: opademo-policy