---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vpn
  labels:
    app.kubernetes.io/name: vpn
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: vpn
  template:
    metadata:
      labels:
        app.kubernetes.io/name: vpn
    spec:
      containers:
        - name: vpn
          image: hwdsl2/ipsec-vpn-server@sha256:61c20bbda3ee6b1cd50f98e6284e654ecae7db48d9d79ce1fcceb12e636f5c33
          imagePullPolicy: Always
          securityContext:
            allowPrivilegeEscalation: true
            privileged: true
          env:
          - name: "VPN_IPSEC_PSK"
            valueFrom:
              secretKeyRef:
                name: vpn-secret
                key: VPN_IPSEC_PSK
          - name: "VPN_USER"
            valueFrom:
              secretKeyRef:
                name: vpn-secret
                key: VPN_USER
          - name: "VPN_PASSWORD"
            valueFrom:
              secretKeyRef:
                name: vpn-secret
                key: VPN_PASSWORD
          - name: "VPN_DNS_NAME"
            value: "vpn.${SECRET_DOMAIN_ME}"
          - name: "VPN_DNS_SRV1"
            value: "192.168.8.1"
          - name: "VPN_IKEV2_ONLY"
            value: "yes"
          ports:
            - containerPort: 500
              hostPort: 500
              name: vpn-isakmp
              protocol: UDP
            - containerPort: 4500
              hostPort: 4500
              name: vpn-ike
              protocol: UDP
          volumeMounts:
            - mountPath: /etc/ipsec.d
              name: vpn-data
      volumes:
        - name: vpn-data
          persistentVolumeClaim:
            claimName: vpn-data
