apiVersion: apps/v1
kind: Deployment
metadata:
  name: flagger-appmesh-gateway
  labels:
    app: flagger-appmesh-gateway
spec:
  selector:
    matchLabels:
      app: flagger-appmesh-gateway
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: flagger-appmesh-gateway
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/path: "/stats/prometheus"
        prometheus.io/port: "8081"
        # exclude inbound traffic on port 8080
        appmesh.k8s.aws/ports: "444"
        # exclude egress traffic to xDS server and Kubernetes API
        appmesh.k8s.aws/egressIgnoredPorts: "18000,22,443"
    spec:
      serviceAccountName: flagger-appmesh-gateway
      terminationGracePeriodSeconds: 45
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: flagger-appmesh-gateway
                topologyKey: kubernetes.io/hostname
              weight: 100
      containers:
        - name: proxy
          image: docker.io/envoyproxy/envoy:v1.12.1
          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
          args:
            - -c
            - /config/envoy.yaml
            - --service-cluster $(POD_NAMESPACE)
            - --service-node $(POD_NAME)
            - --log-level info
            - --base-id 1234
          ports:
            - name: admin
              containerPort: 8081
              protocol: TCP
            - name: http
              containerPort: 8080
              protocol: TCP
          livenessProbe:
            initialDelaySeconds: 5
            tcpSocket:
              port: admin
          readinessProbe:
            initialDelaySeconds: 5
            httpGet:
              path: /ready
              port: admin
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          resources:
            limits:
              memory: 1Gi
            requests:
              cpu: 100m
              memory: 128Mi
          volumeMounts:
            - name: flagger-appmesh-gateway
              mountPath: /config
        - name: controller
          image: docker.io/weaveworks/flagger-appmesh-gateway:v1.0.0
          imagePullPolicy: IfNotPresent
          securityContext:
            readOnlyRootFilesystem: true
            runAsUser: 10001
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
          command:
            - ./flagger-appmesh-gateway
            - --gateway-mesh=appmesh
            - --gateway-name=$(POD_SERVICE_ACCOUNT)
            - --gateway-namespace=$(POD_NAMESPACE)
          env:
            - name: POD_SERVICE_ACCOUNT
              valueFrom:
                fieldRef:
                  fieldPath: spec.serviceAccountName
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          ports:
            - name: grpc
              containerPort: 18000
              protocol: TCP
          livenessProbe:
            initialDelaySeconds: 5
            tcpSocket:
              port: grpc
          readinessProbe:
            initialDelaySeconds: 5
            tcpSocket:
              port: grpc
          resources:
            limits:
              memory: 1Gi
            requests:
              cpu: 10m
              memory: 32Mi
      volumes:
        - name: flagger-appmesh-gateway
          configMap:
            name: flagger-appmesh-gateway
