apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: slasher
  namespace: ethereum-2
  labels:
    app.kubernetes.io/name: slasher
    app.kubernetes.io/version: v1.0.0-beta.3
spec:
  serviceName: slasher
  selector:
    matchLabels:
      app.kubernetes.io/name: slasher
  template:
    metadata:
      labels:
        app.kubernetes.io/name: slasher
        app.kubernetes.io/version: v1.0.0-beta.3
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '8082'
    spec:
      serviceAccountName: slasher
      containers:
      - name: slasher
        image: gcr.io/prysmaticlabs/prysm/slasher:v1.0.0-beta.3
        args:
        - --accept-terms-of-use
        - --beacon-rpc-provider=beacon-chain:4000
        - --beacon-tls-cert=/etc/tls/ca.crt
        - --datadir=/var/lib/slasher
        - --rpc-host=$(POD_IP)
        - --tls-key=/etc/tls/tls.key
        - --tls-cert=/etc/tls/tls.crt
        - --monitoring-host=$(POD_IP)
        - --enable-tracing
        - --tracing-endpoint=http://jaeger-collector:14268/api/traces
        # enabling this requires --enable-new-state-mgmt in beacon-chain
        # - --enable-historical-detection
        env:
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        ports:
        - name: rpc
          containerPort: 4002
        - name: metrics
          containerPort: 8082
        resources:
          requests:
            cpu: 50m
            memory: 128Mi
          limits:
            cpu: 100m
            memory: 256Mi
        volumeMounts:
        - mountPath: /etc/tls
          name: tls
          readOnly: true
        - mountPath: /var/lib/slasher
          name: data
        readinessProbe:
          httpGet:
            path: /healthz
            port: metrics
          failureThreshold: 5
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 10
        livenessProbe:
          httpGet:
            path: /healthz
            port: metrics
          failureThreshold: 5
          initialDelaySeconds: 5
          periodSeconds: 60
          successThreshold: 1
          timeoutSeconds: 30
        securityContext:
          runAsNonRoot: true
          runAsUser: 65534
          readOnlyRootFilesystem: true
          capabilities:
            drop: ["ALL"]
      securityContext:
        fsGroup: 65534
      terminationGracePeriodSeconds: 300
      volumes:
      - name: tls
        secret:
          secretName: slasher-tls
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      storageClassName: standard-rwo
      accessModes:
      - ReadWriteOnce
      volumeMode: Filesystem
      resources:
        requests:
          storage: 3Gi
