apiVersion: apps/v1
kind: Deployment
metadata:
  name: account-deployment
spec:
  selector:
    matchLabels:
      name: account-pod
  replicas: 1
  template:
    metadata:
      labels:
        name: account-pod
    spec:
      containers:
      - name: account
        image: gcr.io/bankingapplication/account-rest:latest
        ports:
        - containerPort: 8080
        resources:
          requests:
            cpu: "50m"
        readinessProbe:
          httpGet:
            path: /healthcheck
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 20
        volumeMounts:
        - name: credentials-secret-volume
          mountPath: /secrets
          readOnly: true
        envFrom:
        - configMapRef:
            name: account-env-configmap
      - name: cloudsql-proxy
        image: gcr.io/cloudsql-docker/gce-proxy:1.16
        command: ["/cloud_sql_proxy",
                  "-instances=bankingapplication:europe-west2:mysql-instance=tcp:3306",
                  "-ip_address_types=PRIVATE",
                  "-credential_file=/secrets/credentials.json"]
        resources:
          requests:
            cpu: "50m"
        securityContext:
          runAsUser: 2  # non-root user
          allowPrivilegeEscalation: false
        volumeMounts:
          - name: credentials-secret-volume
            mountPath: /secrets
            readOnly: true
      volumes:
        - name: credentials-secret-volume
          secret:
            secretName: credentials-secret
