kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    heritage: huv
    app: embed-config-api
  name: embed-config-api
spec:
  selector:
    matchLabels:
      app: embed-config-api 
  template:
    metadata:
      labels:
        app: embed-config-api
      name: embed-config-api
    spec:
      containers:
        - name: config-api
          image: usermirror/config-api:latest
          env:
            - name: CONFIG_API_STORAGE_BACKEND
              value: postgres
            - name: CONFIG_API_POSTGRES_ADDR
              value: postgres://huv_user:${sql_db_password}@localhost:3306/huv-db?sslmode=disable
          ports:
            - name: embed-config
              containerPort: 8888
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /internal/health
              port: 8888
          readinessProbe:
            httpGet:
              path: /internal/health
              port: 8888
        - name: cloudsql-proxy
          image: gcr.io/cloudsql-docker/gce-proxy:1.11
          command: ["/cloud_sql_proxy",
                    "-instances=$(INSTANCE_CONNECTION_NAME)=tcp:3306",
                    "-credential_file=/secrets/cloudsql/service-account-key"]
          env:
          - name: INSTANCE_CONNECTION_NAME
            valueFrom:
              secretKeyRef:
                name: sql-access
                key: instance-connection-name
          securityContext:
            runAsUser: 2  # non-root user
            allowPrivilegeEscalation: false
          volumeMounts:
          - name: sql-access-credentials
            mountPath: /secrets/cloudsql
            readOnly: true
      volumes:
      - name: sql-access-credentials
        secret:
          secretName: sql-access
