---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vpn
  labels:
    app.kubernetes.io/name: vpn
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: vpn
  template:
    metadata:
      labels:
        app.kubernetes.io/name: vpn
    spec:
      containers:
        - name: vpn
          image: trailofbits/algo:latest
          imagePullPolicy: Always
          securityContext:
            allowPrivilegeEscalation: true
            privileged: true
          stdin: true 
          tty: true 
          env:
          - name: "ALGO_ARGS"
            valueFrom:
              secretKeyRef:
                name: algo-secret
                key: ALGO_ARGS
          ports:
            - name: ssh
              containerPort: 4160
              protocol: TCP
            - name: ipsec-ikev2
              containerPort: 500
              protocol: UDP
            - name: ipsec-nat-t
              containerPort: 4500
              protocol: UDP
            - name: wiregurard
              containerPort: 51820
              protocol: UDP
          volumeMounts:
            - mountPath: /data
              name: vpn-data
            - mountPath: /data/config.cfg
              name: vpn-config
              subPath: config.cfg
      volumes:
        - name: vpn-data
          persistentVolumeClaim:
            claimName: vpn-data
        - name: vpn-config
          configMap:
            name: vpn-config
            items:
              - key: config.cfg
                path: config.cfg
                mode: 0644
