apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: $PROJECT
    component: $APP_NAME
  name: $APP_NAME-deployment
  namespace: $NAMESPACE
spec:
  replicas: 2
  selector:
    matchLabels:
      app: $PROJECT
      component: $APP_NAME
  template:
    metadata:
      labels:
        app: $PROJECT
        component: $APP_NAME
      annotations:
        kubesphere.io/containerSecrets: >-
          {"$APP_NAME-container":"$DOCKER_SECRETS"}
    spec:
      # tolerations:
      # - key: "group"
      #   operator: "Equal"
      #   value: "prod"
      #   effect: "NoSchedule"
      # nodeSelector:
      #   env: prod
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - $APP_NAME
              topologyKey: kubernetes.io/hostname
            weight: 100
      initContainers:
      - command:
        - /bin/sh
        - -c
        - |
          sysctl -w net.core.somaxconn=65535
          sysctl -w net.ipv4.ip_local_port_range="1024 65535"
          sysctl -w net.ipv4.tcp_max_syn_backlog=8192
          sysctl -w fs.file-max=1048576
          sysctl -w fs.inotify.max_user_instances=16384
          sysctl -w fs.inotify.max_user_watches=524288
          sysctl -w fs.inotify.max_queued_events=16384
        image: busybox:latest
        name: init-sysctl
        resources: {}
        securityContext:
          privileged: true
          procMount: Default
      restartPolicy: Always

      containers:
        - env:
            - name: TZ
              value: "Asia/Shanghai"
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
          image: '$REGISTRY/$DOCKERHUB_NAMESPACE/$APP_NAME:$VERSION'
          imagePullPolicy: IfNotPresent
          name: $APP_NAME-container
          ports:
          - containerPort: 9080
            name: http
            protocol: TCP
          - containerPort: 9443
            name: https
            protocol: TCP
          # livenessProbe:
          #   failureThreshold: 3
          #   httpGet:
          #     path: /healthz
          #     port: 10254
          #     scheme: HTTP
          #   initialDelaySeconds: 10
          #   periodSeconds: 10
          #   successThreshold: 1
          #   timeoutSeconds: 1
          readinessProbe:
            failureThreshold: 6
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: 9080
            timeoutSeconds: 1
          lifecycle:
            # For alpine based image
            # https://k8s.imroc.io/troubleshooting/cases/dns-lookup-5s-delay
            # postStart:
            #   exec:
            #     command:
            #     - /bin/sh
            #     - -c
            #     - "/bin/echo 'options single-request-reopen' >> /etc/resolv.conf"
            preStop:
              exec:
                command:
                - /bin/sh
                - -c
                - "sleep 30"
          # cpu core(s), 1 == 1000m
          resources:
            limits:
              cpu: '2'
            requests:
              cpu: '50m'

          volumeMounts:
            - mountPath: /usr/local/apisix/conf/config.yaml
              name: $APP_NAME-cm
              subPath: config.yaml
            - mountPath: /etc/localtime
              name: localtime
              readOnly: true
            # - mountPath: /usr/local/apisix/conf/nginx.conf
            #   name: apisix-nginx-conf-configmap
            #   subPath: nginx.conf
            # - mountPath: /usr/local/openresty/openssl/ssl/openssl.cnf
            #   name: apisix-openssl-cnf-configmap
            #   subPath: openssl.cnf

      volumes:
        - configMap:
            name: $APP_NAME-cm
          name: $APP_NAME-cm
        - hostPath:
            path: /etc/localtime
            type: File
          name: localtime
        # - configMap:
        #     name: apisix-gw-nginx.conf
        #   name: apisix-nginx-conf-configmap
        # - configMap:
        #     name: apisix-gw-openssl.cnf.conf
        #   name: apisix-openssl-cnf-configmap
