apiVersion: apps/v1
kind: Deployment
metadata:
  name: oauth-refresher
  labels:
    app: oauth-refresher
spec:
  replicas: 1
  selector:
    matchLabels:
      app: oauth-refresher
  template:
    metadata:
      labels:
        app: oauth-refresher

    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 65535
        runAsGroup: 65535
        fsGroup: 65535

      serviceAccountName: oauth-refresher

      containers:
        - name: oauth-refresher
          image: "djkubelet/oauth-refresher:latest"
          imagePullPolicy: IfNotPresent
          env:
          - name: CLIENT_ID
            valueFrom:
              secretKeyRef:
                name: oauth-refresher
                key: CLIENT_ID
          - name: CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: oauth-refresher
                key: CLIENT_SECRET
          - name: AUTH_URL
            valueFrom:
              secretKeyRef:
                name: oauth-refresher
                key: AUTH_URL
          - name: TOKEN_URL
            valueFrom:
              secretKeyRef:
                name: oauth-refresher
                key: TOKEN_URL

          securityContext:
            readOnlyRootFilesystem: true

          resources:
            limits:
              cpu: 10m
              memory: 20Mi
            requests:
              cpu: 10m
              memory: 20Mi
