apiVersion: apps/v1
kind: Deployment
metadata:
  name: oauth2-proxy
  namespace: oauth2-proxy
  labels:
    app.kubernetes.io/name: oauth2-proxy
    app.kubernetes.io/part-of: oauth2-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: oauth2-proxy
      app.kubernetes.io/part-of: oauth2-proxy
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: oauth2-proxy
        app.kubernetes.io/part-of: oauth2-proxy
    spec:
      nodeSelector:
        beta.kubernetes.io/arch: arm64
      tolerations:
      - key: kubernetes.io/arch
        operator: Equal
        value: arm64
        effect: NoSchedule
      serviceAccountName: oauth2-proxy
      containers:
      - name: oauth2-proxy
        image: quay.io/oauth2-proxy/oauth2-proxy:latest-arm64
        imagePullPolicy: IfNotPresent
        env:
        - name: OAUTH2_PROXY_EMAIL_DOMAINS
          value: "pulsifer.ca"
        - name: OAUTH2_PROXY_HTTP_ADDRESS
          value: "0.0.0.0:4180"
        - name: OAUTH2_PROXY_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: oauth2-proxy
              key: client-id
        - name: OAUTH2_PROXY_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: oauth2-proxy
              key: client-secret
        - name: OAUTH2_PROXY_COOKIE_SECRET
          valueFrom:
            secretKeyRef:
              name: oauth2-proxy
              key: cookie-secret
        ports:
        - containerPort: 4180
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /ping
            port: 4180
          initialDelaySeconds: 3
          periodSeconds: 5
        readinessProbe:
          httpGet:
            path: /ping
            port: 4180
          initialDelaySeconds: 3
          periodSeconds: 5
        resources: {}
