---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations: {}
  labels:
    app: ${REPO_NAME}
  name: ${REPO_NAME}
  namespace: ${NAMESPACE}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ${REPO_NAME}
  template:
    metadata:
      labels:
        app: ${REPO_NAME}
    spec:
      containers:

# orsp app configuration       
      - name: ${REPO_NAME}
        image: gcr.io/${GOOGLE_PROJECT}/${REPO_NAME}:${COMMIT}
        env:
        - name: MYSQL_DB_HOST
          value: 127.0.0.1:3306
        - name: MYSQL_DB_USERNAME
          valueFrom:
            secretKeyRef:
              key: username
              name: cloudsql-db-credentials
        - name: MYSQL_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              key: password
              name: cloudsql-db-credentials
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
        readinessProbe:
          httpGet:
            port: 8080
            path: "/index"
            scheme: HTTP
          initialDelaySeconds: 60
          periodSeconds: 3
          successThreshold: 1
          failureThreshold: 10
          timeoutSeconds: 1
        livenessProbe:
          httpGet:
            port: 8080
            path: "/index"
            scheme: HTTP
          initialDelaySeconds: 120
          periodSeconds: 5
          successThreshold: 1
          failureThreshold: 1
          timeoutSeconds: 1
        volumeMounts:
        - mountPath: "/orsp-config"
          name: orsp-config

# cloudsql-proxy configuration
      - name: cloudsql-proxy
        image: gcr.io/cloudsql-docker/gce-proxy:1.12
        command: ["/cloud_sql_proxy"]
        args: ["-instances=$(MYSQL_INSTANCE)", "-credential_file=/secrets/cloudsql/credentials.json"]
        env:
        - name: MYSQL_INSTANCE
          valueFrom:
            secretKeyRef:
              key: instance
              name: cloudsql-db-credentials
        securityContext:
          allowPrivilegeEscalation: false
          runAsUser: 2
        volumeMounts:
        - mountPath: "/secrets/cloudsql"
          name: cloudsql-instance-credentials
          readOnly: true

# common configuration
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
      volumes:
      - name: cloudsql-instance-credentials
        secret:
          secretName: cloudsql-instance-credentials
      - name: orsp-config
        configMap:
          name:  ${ORSP_CONFIG_MAP}
        
