apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    meta.helm.sh/release-name: traefik
    meta.helm.sh/release-namespace: traefik
  labels:
    app.kubernetes.io/instance: traefik
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: traefik
    helm.sh/chart: traefik-9.8.1
  name: traefik
  namespace: traefik
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: traefik
      app.kubernetes.io/name: traefik
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: traefik
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: traefik
        helm.sh/chart: traefik-9.8.1
    spec:
      containers:
        - args:
            - --global.checknewversion
            - --global.sendanonymoususage
            - --entryPoints.traefik.address=:9000/tcp
            - --entryPoints.web.address=:8000/tcp
            - --entryPoints.websecure.address=:8443/tcp
            - --api.dashboard=true
            - --ping=true
            - --providers.kubernetescrd
            - --providers.kubernetesingress
            - --certificatesResolvers.myresolver.acme.dnsChallenge.provider=gcloud
            - --certificatesresolvers.myresolver.acme.email=youremail@email.com
            - --certificatesresolvers.myresolver.acme.storage=/data/acme.json
            # Please note that this is the staging Let's Encrypt server.
            #  Once you get things working, you should remove that whole line altogether.
            - --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
          env:
            - name: GCE_PROJECT
              value: YOUR_PROJECT_ID
            - name: GCE_SERVICE_ACCOUNT_FILE
              value: /var/secret/google/key.json
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /var/secret/google/key.json
          image: traefik:2.3.1
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /ping
              port: 9000
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          name: traefik
          ports:
            - containerPort: 9000
              name: traefik
              protocol: TCP
            - containerPort: 8000
              name: web
              protocol: TCP
            - containerPort: 8443
              name: websecure
              protocol: TCP
          readinessProbe:
            failureThreshold: 1
            httpGet:
              path: /ping
              port: 9000
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          resources: {}
          securityContext:
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 65532
            runAsNonRoot: true
            runAsUser: 65532
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /data
              name: data
            - mountPath: /tmp
              name: tmp
            - mountPath: /var/secret/google
              name: google-credentials-volume
      dnsPolicy: ClusterFirst
      initContainers:
        - command:
            - sh
            - -c
            - chmod -Rv 600 /data/*
          image: busybox:1.31.1
          imagePullPolicy: IfNotPresent
          name: volume-permissions
          resources: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /data
              name: data
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext:
        fsGroup: 65532
      serviceAccount: traefik
      serviceAccountName: traefik
      terminationGracePeriodSeconds: 60
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: traefik
        - emptyDir: {}
          name: tmp
        - name: google-credentials-volume
          secret:
            defaultMode: 420
            secretName: google-dns-sa
