apiVersion: apps/v1
kind: Deployment
metadata:
  name: jlab-frontend
  namespace: osg-frontends
spec:
  replicas: 1
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  selector:
    matchLabels:
      k8s-app: jlab-frontend
  template:
    metadata:
      labels:
        k8s-app: jlab-frontend
    spec:
      affinity:
        nodeAffinity:
         requiredDuringSchedulingIgnoredDuringExecution:
           nodeSelectorTerms:
           - matchExpressions:
             - key: nautilus.io/region
               operator: In
               values:
               - ucsd
      containers:
      - env:
        - name: VO_POOL
          value: "osg-jlab-1.t2.ucsd.edu, scicollector.jlab.org" 
        - name:  _CONDOR_TOOL_TIMEOUT_MULTIPLIER
          value: "200"
        - name: GWMS_FE_VS_REPO_1
          value: https://github.com/opensciencegrid/osg-flock.git
        name: jlab-frontend
        image: glideinwms/gwms-frontend:dev
        ports:
        - containerPort: 80 
        volumeMounts:
        - mountPath: /var/lib/gwms-frontend/web-area
          name: jlab-storage
        - mountPath: /etc/grid-security/gwms-frontend
          name: proxycerts-secret
          readOnly: true
        - mountPath: /etc/grid-security/voms
          name: vomscerts-secret
          readOnly: true
        - mountPath: /etc/grid-security/eicvoms
          name: eicvomscerts-secret
          readOnly: true
        - mountPath: /etc/gwms-frontend/proxies.ini
          subPath: proxies.ini
          name: proxies-config
        - mountPath: /etc/gwms-frontend/frontend.xml.base
          subPath: frontend.xml.base
          name: fexml-config
        resources:
          limits:
            cpu: 4
            memory: 3Gi
          requests:
            cpu: 3
            memory: 1Gi
      restartPolicy: Always
      volumes:
        - name: jlab-storage
          persistentVolumeClaim:
            claimName: jlab-storage
        - name: proxycerts-secret
          secret:
            secretName: jlabproxycerts
            defaultMode: 0600      #Right File Permissions so can only be read by one node.
        - name:  vomscerts-secret
          secret:
            secretName: jlabvomscerts
            defaultMode: 0600
        - name: proxies-config
          configMap:
             name: jlab-proxies-config
        - name: fexml-config
          configMap:
             defaultMode: 420
             name: jlab-fexml
             items:
             - key: frontend.xml.base
               path: frontend.xml.base
        - name:  eicvomscerts-secret
          secret:
            secretName: eicvomscerts
            defaultMode: 0600
