---
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: prow
  name: deck
  labels:
    app: deck
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
  selector:
    matchLabels:
      app: deck
  template:
    metadata:
      labels:
        app: deck
    spec:
      serviceAccountName: "deck"
      terminationGracePeriodSeconds: 30
      containers:
        - name: deck
          image: gcr.io/k8s-prow/deck:v20211006-258d96010e
          args:
            - --config-path=/etc/config/config.yaml
            - --plugin-config=/etc/plugins/plugins.yaml
            - --tide-url=http://tide/
            - --hook-url=http://hook:8888/plugin-help
            - --github-token-path=/etc/github/token
            - --github-host=github.com
            - --github-endpoint=http://ghproxy
            - --github-endpoint=https://api.github.com
            - --github-graphql-endpoint=http://ghproxy/graphql
            - --job-config-path=/etc/job-config
            - --plugin-config=/etc/plugins/plugins.yaml
            - --s3-credentials-file=/etc/s3-credentials/service-account.json
            - --spyglass=true
          env:
            # Use KUBECONFIG envvar rather than --kubeconfig flag in order to provide multiple configs to merge.
            - name: KUBECONFIG
              value: "/etc/kubeconfig/config"
          ports:
            - name: http
              containerPort: 8080
          volumeMounts:
            - name: config
              mountPath: /etc/config
              readOnly: true
            - name: github-token
              mountPath: /etc/github
              readOnly: true
            - name: job-config
              mountPath: /etc/job-config
              readOnly: true
            - name: plugins
              mountPath: /etc/plugins
              readOnly: true
            - name: kubeconfig
              mountPath: /etc/kubeconfig
              readOnly: true
            - name: s3-credentials
              mountPath: /etc/s3-credentials
              readOnly: true
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 3
            periodSeconds: 3
          readinessProbe:
            httpGet:
              path: /healthz/ready
              port: 8081
            initialDelaySeconds: 10
            periodSeconds: 3
            timeoutSeconds: 600
      volumes:
        - name: config
          configMap:
            name: config
        - name: github-token
          secret:
            secretName: github-token
        - name: job-config
          configMap:
            name: job-config
        - name: kubeconfig
          secret:
            defaultMode: 0644
            secretName: kubeconfig
        - name: plugins
          configMap:
            name: plugins
        - name: s3-credentials
          secret:
            secretName: s3-credentials
