apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-tls-terminator
  labels:
    app: nginx-tls-terminator
spec:
  selector:
    matchLabels:
      app: nginx-tls-terminator
  template:
    metadata:
      labels:
        app: nginx-tls-terminator
    spec:
      containers:
      - name: nginx
        image: nginx:1.21.1-alpine
        ports:
        - containerPort: 80
      - name: nginx-tls-terminator
        image: eknert/nginx-tls-terminator:test
        ports:
        - containerPort: 8443
        volumeMounts:
        - mountPath: /etc/nginx/ssl
          name: tls-terminator-cert
          readOnly: true
        - mountPath: /tmp
          name: tmp
        env:
        - name: PROXY_UPSTREAM_PORT
          value: "80"
        securityContext:
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          runAsUser: 2000
          runAsGroup: 2000
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - all
      volumes:
      - name: tls-terminator-cert
        secret:
          secretName: tls-terminator-cert
      - name: tmp
        emptyDir: {}
