apiVersion: apps/v1
kind: Deployment
metadata:
  name: contour
  namespace: contour-external
  labels:
    app: contour
    networking.knative.dev/ingress-provider: contour
spec:
  replicas: 2
  selector:
    matchLabels:
      app: contour
  template:
    metadata:
      labels:
        app: contour
      annotations:
        prometheus.io/port: "8000"
        prometheus.io/scrape: "true"
    spec:
      dnsPolicy: ClusterFirst
      serviceAccountName: contour
      containers:
      - name: contour
        image: gcr.io/knative-releases/github.com/projectcontour/contour/cmd/contour@sha256:7212e8d3fb415189d5bd361dde75816447a4bd3c5b949c74f6fe2695b9a8d2c4
        command:
        - contour
        args:
        - serve
        - --ingress-class-name=contour-external
        - --incluster
        - --xds-address=0.0.0.0
        - --xds-port=8001
        - --contour-cafile=/certs/ca.crt
        - --contour-cert-file=/certs/tls.crt
        - --contour-key-file=/certs/tls.key
        - --config-path=/config/contour.yaml
        ports:
        - name: xds
          protocol: TCP
          containerPort: 8001
        - name: metrics
          protocol: TCP
          containerPort: 8000
        - name: debug
          protocol: TCP
          containerPort: 6060
        env:
        - name: CONTOUR_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        volumeMounts:
        - name: contourcert
          readOnly: true
          mountPath: /certs
        - name: contour-config
          readOnly: true
          mountPath: /config
        livenessProbe:
          httpGet:
            port: 8000
            path: /healthz
        readinessProbe:
          initialDelaySeconds: 15
          periodSeconds: 10
          tcpSocket:
            port: 8001
        imagePullPolicy: IfNotPresent
      volumes:
      - name: contourcert
        secret:
          secretName: contourcert
      - name: contour-config
        configMap:
          name: contour
          defaultMode: 420
          items:
          - key: contour.yaml
            path: contour.yaml
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchLabels:
                  app: contour
              topologyKey: kubernetes.io/hostname
            weight: 100
      securityContext:
        runAsGroup: 65532
        runAsNonRoot: true
        runAsUser: 65532
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 50%
