apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: teleport-auth
  namespace: teleport
  labels:
    app.kubernetes.io/name: teleport
    app.kubernetes.io/component: auth
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: teleport
      app.kubernetes.io/component: auth
  serviceName: teleport-auth
  replicas: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: teleport
        app.kubernetes.io/component: auth
      annotations:
        prometheus.io/port: "3020"
    spec:
      terminationGracePeriodSeconds: 10
      containers:
      - name: teleport-auth
        image: quay.io/gravitational/teleport-ent
        imagePullPolicy: IfNotPresent
        env:
        - name: NO_PROXY
          value: 10.0.0.0/8,127.0.0.1
        - name: HTTP_PROXY
          value: http://squid.internet-egress.svc:3128
        - name: HTTPS_PROXY
          value: http://squid.internet-egress.svc:3128
        args:
        - --roles=auth
        - --diag-addr=0.0.0.0:3020
        livenessProbe:
          httpGet:
            port: 3020
            path: /healthz
          initialDelaySeconds: 5
          periodSeconds: 5
        readinessProbe:
          httpGet:
            port: 3020
            path: /readyz
          initialDelaySeconds: 5
          periodSeconds: 5
        ports:
        - name: authssh
          containerPort: 3025
        - name: metrics
          containerPort: 3020
        volumeMounts:
        - mountPath: /etc/teleport
          name: teleport-auth-secret
          readOnly: true
        - mountPath: /etc/teleport/role
          name: teleport-role-volume
          readOnly: true
        - mountPath: /var/lib/teleport
          name: teleport-storage
        - mountPath: /tmp
          name: tmp
        - mountPath: /var/lib/license
          name: teleport-enterprise-license
      priorityClassName: node-bound
      securityContext:
        runAsUser: 10000
        runAsGroup: 10000
      volumes:
      - name: teleport-auth-secret
        secret:
          secretName: teleport-auth-secret
      - name: tmp
        emptyDir: {}
      - name: teleport-enterprise-license
        secret:
          secretName: teleport-enterprise-license-dc27mhtbmc
      - name: teleport-role-volume
        configMap:
          name: teleport-role
      serviceAccountName: teleport
  volumeClaimTemplates:
  - metadata:
      name: teleport-storage
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 10Gi
      storageClassName: ceph-ssd-block
