apiVersion: apps/v1
kind: Deployment
metadata:
  name: ishield-api
spec:
  selector:
    matchLabels:
      app: ishield-api
  template:
    metadata:
      labels:
        app: ishield-api
    spec:
      restartPolicy: Always
      serviceAccountName: ishield-sa
      containers:
        - resources:
            limits:
              cpu: 500m
              memory: 512Mi
            requests:
              cpu: 200m
              memory: 256Mi
          readinessProbe:
            httpGet:
              path: /health/readiness
              port: 8080
              scheme: HTTPS
            initialDelaySeconds: 10
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          name: api
          livenessProbe:
            httpGet:
              path: /health/liveness
              port: 8080
              scheme: HTTPS
          env:
            - name: SHIELD_NS
              value: k8s-manifest-sigstore
            - name: REQUEST_HANDLER_CONFIG_KEY
              value: "config.yaml"
            - name: REQUEST_HANDLER_CONFIG_NAME
              value: "request-handler-config"
          ports:
            - name: ishield-api
              containerPort: 8080
              protocol: TCP
          imagePullPolicy: Always
          volumeMounts:
            - name: ishield-api-certs
              readOnly: true
              mountPath: /run/secrets/tls
          image: localhost:5000/k8s-manifest-sigstore-integrity-shield:0.1.0
      serviceAccount: ishield-sa
      volumes:
        - name: ishield-api-certs
          secret:
            secretName: ishield-api-tls
            defaultMode: 420

