apiVersion: apps/v1
kind: Deployment
metadata:
  name: "ltd-proxy"
  labels:
    app.kubernetes.io/name: "ltd-proxy"
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: "ltd-proxy"
  template:
    metadata:
      labels:
        app.kubernetes.io/name: "ltd-proxy"
    spec:
      automountServiceAccountToken: false
      containers:
        - name: app
          imagePullPolicy: "IfNotPresent"
          # Use images field in a Kustomization to set/update image tag
          image: "ghcr.io/jsickcodes/ltd-proxy"
          ports:
            - containerPort: 8080
              name: "app"
          envFrom:
            - configMapRef:
                name: "ltd-proxy"
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - "all"
            readOnlyRootFilesystem: true
          volumeMounts:
             - name: "auth-config"
               mountPath: "/opt/ltd-proxy/auth/"
               readOnly: true
             - name: "rewrites-config"
               mountPath: "/opt/ltd-proxy/rewrites/"
               readOnly: true
      volumes:
        - name: "auth-config"
          configMap:
            name: "ltd-proxy-auth"
        - name: "rewrites-config"
          configMap:
            name: "ltd-proxy-rewrites"
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
