---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgresql
spec:
  selector:
    matchLabels:
      app: postgresql
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: postgresql
    spec:
      containers:
        - name: postgresql
          image: docker.io/library/postgres:12.9
          env:
            - name: PGDATA
              value: /var/lib/postgresql/data
            - name: POSTGRES_DB
              value: postgres
          envFrom:
            - secretRef:
                name: application-secrets
          ports:
            - containerPort: 5432
              hostPort: 5432
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: true
            capabilities:
              drop:
                - CAP_MKNOD
                - CAP_NET_RAW
                - CAP_AUDIT_WRITE
            readOnlyRootFilesystem: false
            runAsGroup: 100
            runAsUser: 568
          volumeMounts:
            - name: config
              mountPath: /var/lib/postgresql/data
      volumes:
        - name: config
          hostPath:
            path: /tycho/System/postgresql
            type: Directory
