apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: spire-server
  namespace: spire
  labels:
    app: spire-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: spire-server
  serviceName: spire-server
  template:
    metadata:
      namespace: spire
      labels:
        app: spire-server
    spec:
      serviceAccountName: spire-server
      containers:
      - name: spire-server
        image: gcr.io/spiffe-io/spire-server:0.9.0
        imagePullPolicy: Always
        args: ["-config", "/run/spire/config/spire-server.conf"]
        ports:
        - containerPort: 8081
        volumeMounts:
        - name: spire-config
          mountPath: /run/spire/config
          readOnly: true
        - name: spire-data
          mountPath: /run/spire/data
          readOnly: false
        - name: k8s-sa-cert
          mountPath: /run/k8s-certs/sa.pub
          readOnly: true
        livenessProbe:
          tcpSocket:
            port: 8081
          failureThreshold: 2
          initialDelaySeconds: 15
          periodSeconds: 60
          timeoutSeconds: 3
      volumes:
      - name: spire-config
        configMap:
          name: spire-server
      - name: k8s-sa-cert
        hostPath:
          path: /var/lib/minikube/certs/sa.pub
          type: File
  volumeClaimTemplates:
  - metadata:
      name: spire-data
      namespace: spire
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 1Gi
