apiVersion: apps/v1
kind: Deployment
metadata:
  name: petkeep-server
  labels:
    app: petkeep
spec:
  replicas: 3
  selector:
    matchLabels:
      app: petkeep
  template:
    metadata:
      labels:
        app: petkeep
    spec:
      serviceAccountName: petkeep-sa
      initContainers:
      # The init-certs container sends a certificate signing request to the
      # kubernetes cluster.
      # You can see pending requests using: kubectl get csr
      # CSRs can be approved using:         kubectl certificate approve <csr name>
      #
      # In addition to the client certificate and key, the init-certs entrypoint will symlink
      # the cluster CA to the certs directory.
      - name: init-certs
        image: cockroachdb/cockroach-k8s-request-cert:0.4
        imagePullPolicy: IfNotPresent
        command:
        - "/bin/ash"
        - "-ecx"
        - "/request-cert -namespace=${POD_NAMESPACE} -certs-dir=/cockroach-certs -type=client -user=petkeep -symlink-ca-from=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        volumeMounts:
        - name: petkeep-client-certs
          mountPath: /cockroach-certs
      containers:
      - name: petkeep-server
        image: rizkybiz/petkeep-server:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
        env:
          - name: API_PORT
            value: "8080"
          - name: API_DATABASE_HOST
            value: "cockroachdb"
          - name: API_DATABASE_PORT
            value: "26257"
          - name: API_DATABASE_USER
            value: "petkeep"
          - name: API_DATABASE_NAME
            value: "petkeep"
          - name: API_JWT_SIGNING_KEY
            value: "rand0m"
          - name: API_LOG_LEVEL
            value: "DEBUG"
          - name: API_INSECURE_DATABASE_CONNECTION
            value: "false"
          - name: API_CERT_PATH
            value: "/opt/petkeep-server/petkeep-client-certs"
          - name: API_STATSD_HOST
            value: "broker"
          - name: API_STATSD_PORT
            value: "8125"
        volumeMounts:
        - name: petkeep-client-certs
          mountPath: /opt/petkeep-server/petkeep-client-certs
      volumes:
      - name: petkeep-client-certs
        emptyDir: {}