apiVersion: apps/v1
kind: Deployment

metadata:
  name: $COMPONENT
  labels:
    app.kubernetes.io/name: $COMPONENT
    app.kubernetes.io/instance: $COMPONENT
    app.kubernetes.io/version: $VERSION
    app.kubernetes.io/component: 5g
    app.kubernetes.io/part-of: open5gs
    app.kubernetes.io/managed-by: open5gs

spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: $COMPONENT
      app.kubernetes.io/instance: $COMPONENT
      app.kubernetes.io/version: $VERSION
      app.kubernetes.io/component: 5g
  template:
    metadata:
      labels:
        app.kubernetes.io/name: $COMPONENT
        app.kubernetes.io/instance: $COMPONENT
        app.kubernetes.io/version: $VERSION
        app.kubernetes.io/component: 5g
        app.kubernetes.io/part-of: open5gs
        app.kubernetes.io/managed-by: open5gs
    spec:
      hostname: ${COMPONENT}-1
      subdomain: open5gs
      containers:
      - name: main 
        image: $IMAGE
        imagePullPolicy: Always
        volumeMounts: 
          - name: ${COMPONENT}-cfg 
            mountPath: /etc/open5gs/${COMPONENT}.yaml
            subPath: ${COMPONENT}.yaml
          - name: ${COMPONENT}-cfg
            mountPath: /etc/freeDiameter/${COMPONENT}.conf
            subPath: ${COMPONENT}.conf
          - name: tls
            mountPath: /etc/tls
        env:
          - name: COMPONENT
            value: $COMPONENT
        securityContext:
          capabilities:
            add:
            - "NET_RAW" # enables "ping"
            - "NET_ADMIN" # enabled access to "/dev/net/tun" (not enough)
          privileged: true # HACK to enable "/dev/net/tun"
      volumes:
      - name: ${COMPONENT}-cfg
        configMap:
          name: $COMPONENT
      - name: tls
        secret: 
          secretName: $COMPONENT
          optional: true
