# Pod deployment for the statement analysis service.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: statement-analysis
spec:
  replicas: 1
  selector:
    matchLabels:
      app: statement-analysis
  template:
    metadata:
      labels:
        app: statement-analysis
      annotations:
        container.seccomp.security.alpha.kubernetes.io/statement-analysis-service: localhost/seccomp-policy.json
    spec:
      initContainers:
      - name: ccr-init
        image: foo.azurecr.io/ccr-init:latest
        securityContext:
          capabilities:
            add: ["NET_ADMIN","NET_RAW"]
            drop: ["ALL"]
      containers:
      - name: statement-analysis-service
        image: foo.azurecr.io/statement-analysis-service:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
        env:
        # Environment variable used by Python Requests library to setup the proxy.
        - name: HTTP_PROXY
          value: "http://127.0.0.1:15001/"
        securityContext:
          allowPrivilegeEscalation: false
          privileged: false
          capabilities:
            drop: ["ALL"]
      - name: ccr-proxy
        image: envoyproxy/envoy:v1.20-latest
        ports:
        - containerPort: 15000
        args:
        - "envoy"
        - "-c"
        - "/config/ccr-proxy-config.yaml"
        - "-l"
        - "trace"
        env:
        - name: ENVOY_UID
          value: "1337"
        - name: ENVOY_GID
          value: "1337"
        volumeMounts:
          - name: ccr-proxy-config
            mountPath: /config
            readOnly: true
      - name: ccr-sidecar
        image: foo.azurecr.io/ccr-sidecar:latest
        imagePullPolicy: Always
        args:
        - "-c"
        - "/config/ccr-sidecar-config.yaml"
        ports:
        - containerPort: 8281
        securityContext:
          runAsUser: 1337
          runAsGroup: 1337
        volumeMounts:
          - name: ccr-sidecar-config
            mountPath: /config
            readOnly: true
      - name: policy-engine
        image: openpolicyagent/opa:latest-rootless
        imagePullPolicy: Always
        ports:
        - containerPort: 8282
        args:
        - "run"
        - "--ignore=.*"
        - "--server"
        - "--addr=0.0.0.0:8282"
        - "--log-level"
        - "debug"
        - "--log-format"
        - "text"
        - "/policies"
        volumeMounts:
          - name: ccr-policy
            mountPath: /policies
            readOnly: true
      - name: crypto-sidecar
        image: foo.azurecr.io/crypto-sidecar:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 8283
      volumes:
      - name: ccr-proxy-config
        configMap:
          name: ccr-proxy-config
      - name: ccr-sidecar-config
        configMap:
          name: sa-ccr-sidecar-config
      - name: ccr-policy
        configMap:
          name: ccr-policy
