apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/instance: traefik
    app.kubernetes.io/managed-by: tmax-cloud
    app.kubernetes.io/name: api-gateway
  name: api-gateway
  namespace: api-gateway-system
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/instance: traefik
      app.kubernetes.io/name: api-gateway
      app.kubernetes.io/managed-by: tmax-cloud
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: traefik
        app.kubernetes.io/managed-by: tmax-cloud
        app.kubernetes.io/name: api-gateway
    spec:
      containers:
      - args:
        - --entryPoints.traefik.address=:9000
        - --entryPoints.web.address=:80
        - --entryPoints.websecure.address=:443
        # http.tls 설정을 하면 websecure를 entrypoint로 사용하면 모든 서비스에 대해 자동으로 기본 tls 적용을 함 (따로 설정을 안해줘도 됌)
        - --entrypoints.websecure.http.tls
        - --entryPoints.k8s.address=:6443
        - --entryPoints.9001.address=:9001
        - --entrypoints.9001.http.tls
        - --entryPoints.9002.address=:9002
        - --entrypoints.9002.http.tls
        - --entryPoints.9003.address=:9003
        - --entrypoints.9003.http.tls
          #        insecureSkipVerify disables SSL certificate verification.
        - --serverstransport.insecureskipverify=true # disables SSL certificate verification. (verify ssl certificate beween traefik - backend)
        ## user rootCAs :rootCAs is the list of certificates (as file paths, or data bytes) that will be set as Root Certificate Authorities when using a self-signed TLS certificate.
#        - --serverstransport.rootcas=/etc/ssl/tmax/ca.cert
        # Uncomment the below lines to redirect http requests to https.
        - --entryPoints.web.http.redirections.entrypoint.to=websecure
        - --entryPoints.web.http.redirections.entrypoint.scheme=https
        - --api=true 
        # - --api.dashboard=true
        - --ping=true
        # - --ping.entrypoint=traefik
        - --providers.kubernetesingress=true
        # - --providers.kubernetesingress.labelselector="app=traefik"
        # Value of kubernetes.io/ingress.class annotation that identifies Ingress objects to be processed.
        - --providers.kubernetesingress.ingressclass=tmax-cloud
        # Traefik processes all Ingress objects in the configured namespaces.
#        - --providers.kubernetesingress.namespaces=console-system,api-gateway-system,hyperregistry,moniotring
        - --providers.kubernetesingress.ingressendpoint.publishedservice=api-gateway-system/api-gateway
        - --providers.kubernetesingress.allowemptyservices=true
        - --providers.kubernetesingress.allowexternalnameservices=true
        - --providers.kubernetescrd
        - --providers.kubernetescrd.allowcrossnamespace=true
        - --providers.kubernetesgateway=true
        - --providers.file
        - --providers.file.directory=/data/config
        - --providers.file.watch=true
        - --log.level=ERROR
        - --log.format=json  
        - --accesslog=true
        - --accesslog.format=json
        - --accesslog.filepath=/var/log/gateway/access.log
        - --accesslog.bufferingsize=500
        - --accesslog.fields.headers.defaultmode=keep
        - --accesslog.filters.statuscodes=300-600
        image: traefik:v2.5.2
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /ping
            port: 9000
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 2
        name: gateway
        ports:
        - containerPort: 9000
          name: traefik
          protocol: TCP
        - containerPort: 80
          name: web
          protocol: TCP
        - containerPort: 443
          name: websecure
          protocol: TCP
        - containerPort: 6443
          name: k8s
          protocol: TCP
        - containerPort: 9001
          name: kafka1
          protocol: TCP
        - containerPort: 9002
          name: kafka2
          protocol: TCP
        - containerPort: 9003
          name: kafka3
          protocol: TCP
        readinessProbe:
          failureThreshold: 1
          httpGet:
            path: /ping
            port: 9000
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 2
        resources: {}
        ## securtContext를 아래와같이하면 80,433 port 이용 못함 2021/09/15 07:35:02 traefik.go:81: command traefik error: error while building entryPoint web: error preparing server: error opening listener: listen tcp :80: bind: permission denied
        # securityContext:
        #   capabilities:
        #     drop:
        #     - ALL
        #   readOnlyRootFilesystem: true
        #   runAsGroup: 65532
        #   runAsNonRoot: false
        #   runAsUser: 65532
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /data/config
          name: configmap-volume
          readOnly: true
        - mountPath: /etc/ssl/tmax
          name: gateway-cert
          readOnly: true
        - name: logs
          mountPath: /var/log/gateway
#          readOnly: true
      - name: console 
        command:
          - /opt/bridge/bin/console
          - server 
          - --public-dir=/opt/bridge/static 
          - --listen=http://0.0.0.0:31303
          - --base-address=http://0.0.0.0:31303 
          - --keycloak-realm=tmax
          - --keycloak-auth-url=https://hyperauth.org/auth 
          - --keycloak-client-id=ck-integration-hypercloud
          - --mc-mode=true
          - --release-mode=true
          # - --tls-cert-file=/var/https-cert/cert
          # - --tls-key-file=/var/https-cert/key
        image: tmaxcloudck/hypercloud-console:v21.0.8.1
        imagePullPolicy: IfNotPresent
        ports:
          - containerPort: 31303
            protocol: TCP
            name: console
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      - name: jwt-decode
        env:
          - name: JWKS_URL
            value: https://hyperauth.org/auth/realms/tmax/protocol/openid-connect/certs
          - name: AUTH_HEADER_KEY
            value: Authorization
          - name: CACHE_ENABLED
            value: "true"
#          - name: CLAIM_MAPPING_FILE_PATH
#            value: /claim-mappings/config.json
          - name: LOG_LEVEL
            value: debug
          - name: LOG_TYPE
            value: pretty
          - name: MAX_CACHE_KEYS
            value: "10000"
          - name: PORT
            value: "8080"
          - name: TOKEN_VALIDATED_HEADER_KEY
            value: jwt-token-validated
        image: tmaxcloudck/jwt-decode:5.0.0.0
        imagePullPolicy: IfNotPresent
        ports:
          - name: jwt-decode
            protocol: TCP
            containerPort: 8080
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      # securityContext:
      #   fsGroup: 65532
      serviceAccountName: api-gateway
      terminationGracePeriodSeconds: 60
      volumes:
      - name: configmap-volume
        configMap: 
          name: console-config
      - name: gateway-cert
        secret:
          defaultMode: 288
          secretName: tmaxcloud-gateway-selfsigned
      - name: logs
        emptyDir: {}