apiVersion: apps/v1
kind: Deployment
metadata:
  name: wordpress
  labels:
    app: wordpress
  annotations:
    value: 'wow'
    cost-estimator.kpt.io/monthly-cost: '44.03'
spec:
  replicas: 4
  selector:
    matchLabels:
      app: wordpress
  template:
    metadata:
      labels:
        app: wordpress
    spec:
      containers:
      - image: wordpress
        name: wordpress
        resources:
          requests:
            memory: "256Mi"
            cpu: "200m"
          limits:
            memory: "256Mi"
            cpu: "250m"
        env:
        - name: WORDPRESS_DB_HOST
          value: 127.0.0.1:3306
        - name: WORDPRESS_DB_USER # These secrets are required to start the pod.
          valueFrom:
            secretKeyRef:
              name: cloudsql-db-credentials
              key: username
        - name: WORDPRESS_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: cloudsql-db-credentials
              key: password
        ports:
        - containerPort: 80
          name: wordpress
        volumeMounts:
        - name: wordpress-persistent-storage
          mountPath: /var/www/html
      # Change ${INSTANCE_CONNECTION_NAME} here to include your GCP
      # project, the region of your Cloud SQL instance and the name
      # of your Cloud SQL instance. The format is
      # $PROJECT:$REGION:$INSTANCE
      - name: cloudsql-proxy
        image: gcr.io/cloudsql-docker/gce-proxy:1.11
        resources:
          requests:
            memory: "3840Mi"
            cpu: "200m"
          limits:
            memory: "64Mi"
            cpu: "250m"
        command: ["/cloud_sql_proxy", "-instances=${INSTANCE_CONNECTION_NAME}=tcp:3306",
          # If running on a VPC, the Cloud SQL proxy can connect via Private IP. See:
          # https://cloud.google.com/sql/docs/mysql/private-ip for more info.
          # "-ip_address_types=PRIVATE",
          "-credential_file=/secrets/cloudsql/key.json"]
        securityContext:
          runAsUser: 2 # non-root user
          allowPrivilegeEscalation: false
        volumeMounts:
        - name: cloudsql-instance-credentials
          mountPath: /secrets/cloudsql
          readOnly: true
      volumes:
      - name: wordpress-persistent-storage
        persistentVolumeClaim:
          claimName: wordpress-volumeclaim
      - name: cloudsql-instance-credentials
        secret:
          secretName: cloudsql-instance-credentials
