apiVersion: apps/v1
kind: Deployment

metadata:
  name: $COMPONENT
  labels:
    app.kubernetes.io/name: $COMPONENT
    app.kubernetes.io/instance: $COMPONENT
    app.kubernetes.io/version: $VERSION
    app.kubernetes.io/component: 5g
    app.kubernetes.io/part-of: open5gs
    app.kubernetes.io/managed-by: open5gs

spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: $COMPONENT
      app.kubernetes.io/instance: $COMPONENT
      app.kubernetes.io/version: $VERSION
      app.kubernetes.io/component: 5g
  template:
    metadata:
      labels:
        app.kubernetes.io/name: $COMPONENT
        app.kubernetes.io/instance: $COMPONENT
        app.kubernetes.io/version: $VERSION
        app.kubernetes.io/component: 5g
        app.kubernetes.io/part-of: open5gs
        app.kubernetes.io/managed-by: open5gs
    spec:
      serviceAccountName: open5gs
      containers:
      - name: main
        image: $REGISTRY/$IMAGE_TAG
        imagePullPolicy: Always
        env:
        - name: COMPONENT
          value: $COMPONENT
        volumeMounts:
        - mountPath: /etc/open5gs/$COMPONENT.yaml.template
          name: config
          subPath: $COMPONENT.yaml
        - mountPath: /etc/freeDiameter/$COMPONENT.conf
          name: config
          subPath: $COMPONENT.conf
          # Note: if the subPath is not found in the volume an directory of this name will be created
        - mountPath: /etc/tls
          name: tls
        securityContext:
          capabilities:
            add:
            - NET_RAW # enables "ping"
            - NET_ADMIN # enables access to "/dev/net/tun" (TODO doesn't work)
          privileged: true # HACK to access "/dev/net/tun"
      volumes:
      - name: config
        configMap:
          name: $COMPONENT
      - name: tls
        secret:
          secretName: $COMPONENT
          optional: true
