apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: validator
  namespace: ethereum-2
  labels:
    app.kubernetes.io/name: validator
    app.kubernetes.io/version: v1.0.0-beta.3
spec:
  serviceName: validator
  selector:
    matchLabels:
      app.kubernetes.io/name: validator
  template:
    metadata:
      labels:
        app.kubernetes.io/name: validator
        app.kubernetes.io/version: v1.0.0-beta.3
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '8081'
    spec:
      serviceAccountName: validator
      containers:
      - name: validator
        image: gcr.io/prysmaticlabs/prysm/validator:v1.0.0-beta.3
        args:
        - --accept-terms-of-use
        - --beacon-rpc-provider=beacon-chain:4000
        - --tls-cert=/etc/tls/ca.crt
        - --wallet-dir=/etc/ethereum/keystore
        - --wallet-password-file=/etc/ethereum/keystore/derived/password.txt
        - --datadir=/var/lib/validator
        - --graffiti=AllYouCanStake.de
        - --monitoring-host=$(POD_IP)
        # - --enable-external-slasher-protection
        # - --slasher-rpc-provider=slasher:4002
        # - --slasher-tls-cert=/etc/tls/ca.crt
        - --enable-tracing
        - --tracing-endpoint=http://jaeger-collector:14268/api/traces
        env:
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        ports:
        - name: metrics
          containerPort: 8081
        resources:
          requests:
            cpu: 50m
            memory: 128Mi
          limits:
            cpu: 100m
            memory: 256Mi
        volumeMounts:
        - mountPath: /etc/ethereum/keystore/derived
          name: keystore
          readOnly: true
        - mountPath: /etc/tls
          name: tls
          readOnly: true
        - mountPath: /var/lib/validator
          name: data
        readinessProbe:
          httpGet:
            path: /healthz
            port: metrics
          failureThreshold: 5
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 10
        livenessProbe:
          httpGet:
            path: /healthz
            port: metrics
          failureThreshold: 5
          initialDelaySeconds: 5
          periodSeconds: 60
          successThreshold: 1
          timeoutSeconds: 30
        securityContext:
          runAsNonRoot: true
          runAsUser: 65534
          readOnlyRootFilesystem: true
          capabilities:
            drop: ["ALL"]
      securityContext:
        fsGroup: 65534
      terminationGracePeriodSeconds: 300
      volumes:
      - name: keystore
        secret:
          secretName: keystore
      - name: tls
        secret:
          secretName: validator-tls
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      storageClassName: standard-rwo
      accessModes:
      - ReadWriteOnce
      volumeMode: Filesystem
      resources:
        requests:
          storage: 1Gi
