apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: console
  name: console
spec:
  replicas: 1
  selector:
    matchLabels:
      app: console
  template:
    metadata:
      labels:
        app: console
    spec:
      serviceAccountName: console
      securityContext:
        runAsNonRoot: true
        runAsUser: 65535
        runAsGroup: 65535
        fsGroup: 65535

      containers:
      - image: djkubelet/console:latest
        name: console
        imagePullPolicy: IfNotPresent
        command:
        - /console
        args:
        - --port=:8443
        - --base-url=https://localhost:8443
        - --cert-file=/etc/tls/tls.crt
        - --key-file=/etc/tls/tls.key
        env:
        - name: CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: console
              key: CLIENT_ID
        - name: CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: console
              key: CLIENT_SECRET
        - name: COOKIE_STORE_AUTH_KEY
          valueFrom:
            secretKeyRef:
              name: console
              key: COOKIE_STORE_AUTH_KEY
        - name: COOKIE_STORE_ENCRYPTION_KEY
          valueFrom:
            secretKeyRef:
              name: console
              key: COOKIE_STORE_ENCRYPTION_KEY
        volumeMounts:
        - name: server-tls
          mountPath: "/etc/tls"
        securityContext:
          readOnlyRootFilesystem: true
        livenessProbe:
          httpGet:
            path: /health
            port: 8443
            scheme: HTTPS
          initialDelaySeconds: 30
          timeoutSeconds: 5
        resources:
          limits:
            cpu: 10m
            memory: 20Mi
          requests:
            cpu: 10m
            memory: 20Mi
      volumes:
      - name: server-tls
        secret:
          secretName: server-tls
