apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    router: router
  name: router
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      router: router
  strategy:
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        router: router
    spec:
      containers:
      - env:
        - name: DEFAULT_CERTIFICATE_DIR
          value: /etc/pki/tls/private
        - name: DEFAULT_CERTIFICATE_PATH
          value: /etc/pki/tls/private/tls.crt
        - name: ROUTER_EXTERNAL_HOST_INSECURE
          value: "false"
        - name: ROUTER_EXTERNAL_HOST_PRIVKEY
          value: /etc/secret-volume/router.pem
        - name: ROUTER_LISTEN_ADDR
          value: 0.0.0.0:1936
        - name: ROUTER_METRICS_TYPE
          value: haproxy
        - name: ROUTER_SERVICE_HTTPS_PORT
          value: "443"
        - name: ROUTER_SERVICE_HTTP_PORT
          value: "80"
        - name: ROUTER_SERVICE_NAME
          value: router
        - name: ROUTER_SERVICE_NAMESPACE
          value: default
        - name: STATS_PASSWORD
          value: '*** GENERATED ***'
        - name: STATS_PORT
          value: "1936"
        - name: STATS_USERNAME
          value: admin
        image: '*** GENERATED ***'
        livenessProbe:
          httpGet:
            path: /healthz
            port: 1936
            scheme: HTTP
          initialDelaySeconds: 10
        name: router
        ports:
        - containerPort: 80
          name: http
        - containerPort: 443
          name: https
        - containerPort: 1936
          name: stats
        readinessProbe:
          httpGet:
            path: /healthz
            port: 1936
            scheme: HTTP
          initialDelaySeconds: 10
        resources:
          requests:
            cpu: 100m
            memory: 256Mi
        volumeMounts:
        - mountPath: /etc/pki/tls/private
          name: server-certificate
          readOnly: true
      nodeSelector:
        region: infra
      serviceAccountName: router
      volumes:
      - name: server-certificate
        secret:
          secretName: router-certs
