apiVersion: apps/v1
kind: Deployment
metadata:
  name: connector-bridge
  labels:
    app: connector-bridge
spec:
  replicas: 1
  selector:
    matchLabels:
      app: connector-bridge
  template:
    metadata:
      labels:
        app: connector-bridge
    spec:
      restartPolicy: Always
      serviceAccountName: connector-bridge
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/arch
                    operator: In
                    values:
                      - amd64
                  - key: kubernetes.io/os
                    operator: In
                    values:
                      - linux
      containers:
        - image: quay.io/zach_robinson/connector-bridge:amd64-latest
          imagePullPolicy: Always
          name: connector-bridge
          ports:
            - containerPort: 8443
              name: grpc
              protocol: TCP
            - containerPort: 8080
              name: metrics
              protocol: TCP
          resources:
            requests:
              cpu: 250m
              memory: 64Mi
              ephemeral-storage: "0"
            limits:
              cpu: "1"
              memory: 500Mi
              ephemeral-storage: 200Mi
          livenessProbe:
            exec:
              command:
                - grpc_health_probe
                - --addr=localhost:8443
                - --connect-timeout=4s
                - --rpc-timeout=4s
                - --tls
                - --tls-ca-cert=/config/tls/ca.crt
                - --tls-client-cert=/config/tls_client/tls.crt
                - --tls-client-key=/config/tls_client/tls.key
            initialDelaySeconds: 10
            successThreshold: 1
            failureThreshold: 3
            periodSeconds: 10
            timeoutSeconds: 10
          readinessProbe:
            exec:
              command:
                - grpc_health_probe
                - --addr=localhost:8443
                - --connect-timeout=2s
                - --rpc-timeout=2s
                - --tls
                - --tls-ca-cert=/config/tls/ca.crt
                - --tls-client-cert=/config/tls_client/tls.crt
                - --tls-client-key=/config/tls_client/tls.key
            initialDelaySeconds: 5
            successThreshold: 1
            failureThreshold: 3
            periodSeconds: 5
            timeoutSeconds: 5
          volumeMounts:
            - mountPath: /config/kafka
              name: kafkaconf
              readOnly: true
            - mountPath: /config/tls
              name: cert
              readOnly: true
            - mountPath: /config/tls_client
              name: client
              readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            privileged: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
      hostNetwork: false
      hostPID: false
      hostIPC: false
      terminationGracePeriodSeconds: 30
      volumes:
        - name: kafkaconf
          secret:
            secretName: aiopsedge-kafka-application-secret
        - name: cert
          secret:
            secretName: connector-bridge-cert-secret
        - name: client
          secret:
            secretName: aiopsedge-client-cert

