kind: Deployment
apiVersion: apps/v1
metadata:
  name: kafka-proxy
  labels:
    app: kafka-proxy
  namespace: kafka  
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kafka-proxy
  template:
    metadata:
      labels:
        app: kafka-proxy
    spec:
      containers:
        - name: opa
          # Note: openpolicyagent/opa:latest-envoy is created by retagging
          # the latest released image of OPA-Envoy.
          image: openpolicyagent/opa:latest-envoy
          securityContext:
            runAsUser: 1111
          volumeMounts:
          - readOnly: true
            mountPath: /policy
            name: opa-policy
          args:
          - "run"
          - "--server"
          - "--addr=localhost:8181"
          - "--diagnostic-addr=0.0.0.0:8282"
          - "--set=plugins.envoy_ext_authz_grpc.addr=:9191"
          - "--set=plugins.envoy_ext_authz_grpc.query=data.envoy.authz.allow"
          - "--set=decision_logs.console=true"
          - "--ignore=.*"
          - "/policy/allow_all.rego"
          livenessProbe:
            httpGet:
              path: /health?plugins
              scheme: HTTP
              port: 8282
            initialDelaySeconds: 5
            periodSeconds: 5
          readinessProbe:
            httpGet:
              path: /health?plugins
              scheme: HTTP
              port: 8282
            initialDelaySeconds: 5
            periodSeconds: 5      
        - name: envoy
          image: envoyproxy/envoy:v1.15.3
          ports:
            - containerPort: 19092
              protocol: TCP
            - containerPort: 19093
              protocol: TCP              
          volumeMounts:
          - readOnly: true
            mountPath: /config
            name: proxy-config
          - name: spire-agent-socket
            mountPath: /run/spire/sockets
            readOnly: true             
          args:
          - "envoy"
          - "--config-path"
          - "/config/envoy.yaml"
      volumes:
        - name: proxy-config
          configMap:
            name: kafka-proxy-config
        - name: spire-agent-socket
          hostPath:
            path: /run/spire/sockets
            type: Directory
        - name: opa-policy
          configMap:
            name: kafka-policy