apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: proxy
    app.kubernetes.io/name: oauth2-proxy
    app.kubernetes.io/part-of: auth
    app.kubernetes.io/version: 7.1.3
  name: oauth2-proxy
  namespace: auth
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/component: proxy
      app.kubernetes.io/name: oauth2-proxy
      app.kubernetes.io/part-of: auth
  template:
    metadata:
      labels:
        app.kubernetes.io/component: proxy
        app.kubernetes.io/name: oauth2-proxy
        app.kubernetes.io/part-of: auth
        app.kubernetes.io/version: 7.1.3
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app.kubernetes.io/name
                  operator: In
                  values:
                  - oauth2-proxy
              topologyKey: kubernetes.io/hostname
            weight: 100
      containers:
      - args:
        - --provider=google
        - --email-domain=krupa.net.pl
        - --cookie-domain=.ankhmorpork.thaum.xyz
        - --whitelist-domain=.ankhmorpork.thaum.xyz
        - --pass-host-header=true
        - --set-xauthrequest=true
        - --pass-basic-auth=false
        - --http-address=0.0.0.0:4180
        - --metrics-address=0.0.0.0:8080
        envFrom:
        - secretRef:
            name: oauth-creds
        image: quay.io/paulfantom/oauth2-proxy:7.1.3
        imagePullPolicy: IfNotPresent
        name: oauth2-proxy
        ports:
        - containerPort: 4180
          name: http
        - containerPort: 8080
          name: metrics
        resources:
          limits:
            cpu: 30m
            memory: 30Mi
          requests:
            cpu: 10m
            memory: 13Mi
      nodeSelector:
        network.infra/type: fast
      restartPolicy: Always
      serviceAccountName: oauth2-proxy
