apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: hanalon-bot
  namespace: hanalon
  annotations:
    seccomp.security.alpha.kubernetes.io/pod: "docker/default"
spec:
  replicas: 1
  serviceName: bot
  selector:
    matchLabels:
      hanalon: bot
  template:
    metadata:
      labels:
        hanalon: bot
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: "docker/default"
    spec:
      dnsPolicy: Default
      containers:
        - name: bot
          image: hanalon/bot
          env:
            - name: config
              valueFrom:
                secretKeyRef:
                  name: hanalon-secret
                  key: config
            - name: shard_count
              value: "1"
            - name: pod_name
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
          resources:
            limits:
              memory: "512Mi"
              cpu: "500m"
            requests:
              memory: "128Mi"
              cpu: "125m"
          securityContext:
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - NET_RAW
                - ALL
      automountServiceAccountToken: false
