# deploynent.devpod.yaml
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: devpod
  namespace: devpod
  labels:
    app: devpod
spec:
  replicas: 1
  selector:
    matchLabels:
      app: devpod
  template:
    metadata:
      labels:
        app: devpod
    spec:
      securityContext:
        runAsUser: 33333
        runAsGroup: 33333
        fsGroup: 33333
      containers:
        - name: puppet-oraclelinux-7
          image: devpod-puppet-oraclelinux:7
          # https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
          imagePullPolicy: Never
          env:
          - name: SECRET_CONTROL_REPO_URL
            valueFrom:
              secretKeyRef:
                name: git-remotes
                key: control-repo  
          # https://github.com/kubernetes/kubernetes/issues/34982
          lifecycle:
            postStart:
              exec:
                command:
                  - /bin/bash
                  - -c
                  - /usr/bin/cp -aL /home/localdev/.user-gitconfig/.gitconfig /home/localdev/.gitconfig && /bin/mkdir -p /home/localdev/.ssh && /bin/chmod 700 /home/localdev/.ssh && /bin/cp -aL /home/localdev/.ssh-egress/* /home/localdev/.ssh && /bin/chmod 600 /home/localdev/.ssh/id_ed25519 && /bin/chmod 644 /home/localdev/.ssh/known_hosts /home/localdev/.ssh/id_ed25519.pub
          securityContext:
            runAsUser: 33333
            runAsGroup: 33333
            capabilities:
              add:
                - NET_ADMIN
                - SYS_PTRACE
          command: ["tail", "-f", "/dev/null"]
          volumeMounts:
            - name: workspaces
              mountPath: /workspace
            # - mountPath: /workspace
            #   name: code-volume
            - mountPath: /home/localdev/.cache
              name: cache-volume
              readOnly: true
            - name: ssh-egress
              # https://github.com/kubernetes/kubernetes/issues/34982
              mountPath: "/home/localdev/.ssh-egress"
              readOnly: true
            - name: user-gitconfig
              mountPath: "/home/localdev/.user-gitconfig"
              readOnly: true
            - name: r10k-config
              mountPath: "/etc/puppetlabs/r10k/r10k.yaml"
              readOnly: true
          resources:
            limits:
              memory: 1024Mi
              cpu: ".75"
            requests:
              memory: 512Mi
              cpu: ".75"
        - name: puppet-oraclelinux-8
          image: devpod-puppet-oraclelinux:8
          # https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
          imagePullPolicy: Never
          env:
          - name: SECRET_CONTROL_REPO_URL
            valueFrom:
              secretKeyRef:
                name: git-remotes
                key: control-repo  
          # https://github.com/kubernetes/kubernetes/issues/34982
          lifecycle:
            postStart:
              exec:
                command:
                  - /usr/bin/bash
                  - -c
                  - /usr/bin/cp -aL /home/localdev/.user-gitconfig/.gitconfig /home/localdev/.gitconfig && /usr/bin/mkdir -p /home/localdev/.ssh && /usr/bin/chmod 700 /home/localdev/.ssh && /usr/bin/cp -aL /home/localdev/.ssh-egress/* /home/localdev/.ssh && /usr/bin/chmod 600 /home/localdev/.ssh/id_ed25519 && /usr/bin/chmod 644 /home/localdev/.ssh/known_hosts /home/localdev/.ssh/id_ed25519.pub
          securityContext:
            runAsUser: 33333
            runAsGroup: 33333
            capabilities:
              add:
                - NET_ADMIN
                - SYS_PTRACE
          command: ["tail", "-f", "/dev/null"]
          volumeMounts:
            - name: workspaces
              mountPath: /workspace
            # - mountPath: /workspace
            #   name: code-volume
            - mountPath: /home/localdev/.cache
              name: cache-volume
              readOnly: true
            - name: ssh-egress
              # https://github.com/kubernetes/kubernetes/issues/34982
              mountPath: "/home/localdev/.ssh-egress"
              readOnly: true
            - name: user-gitconfig
              mountPath: "/home/localdev/.user-gitconfig"
              readOnly: true
            - name: r10k-config
              mountPath: "/etc/puppetlabs/r10k/r10k.yaml"
              readOnly: true
          resources:
            limits:
              memory: 1024Mi
              cpu: ".4"
            requests:
              memory: 512Mi
              cpu: ".4"
        - name: puppet-ubuntu-bionic
          image: devpod-puppet-ubuntu:bionic
          # https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
          env:
          - name: SECRET_CONTROL_REPO_URL
            valueFrom:
              secretKeyRef:
                name: git-remotes
                key: control-repo            
          imagePullPolicy: Never
          # https://github.com/kubernetes/kubernetes/issues/34982
          lifecycle:
            postStart:
              exec:
                command:
                  - /bin/bash
                  - -c
                  - /bin/cp -aL /home/localdev/.user-gitconfig/.gitconfig /home/localdev/.gitconfig && /bin/mkdir -p /home/localdev/.ssh && /bin/chmod 700 /home/localdev/.ssh && /bin/cp -aL /home/localdev/.ssh-egress/* /home/localdev/.ssh && /bin/chmod 600 /home/localdev/.ssh/id_ed25519 && /bin/chmod 644 /home/localdev/.ssh/known_hosts /home/localdev/.ssh/id_ed25519.pub
          securityContext:
            runAsUser: 33333
            runAsGroup: 33333
            capabilities:
              add:
                - NET_ADMIN
                - SYS_PTRACE
          command: ["tail", "-f", "/dev/null"]
          volumeMounts:
            - name: workspaces
              mountPath: /workspace
            # - mountPath: /workspace
            #   name: code-volume
            - mountPath: /home/localdev/.cache
              name: cache-volume
              readOnly: true
            - name: ssh-egress
              # https://github.com/kubernetes/kubernetes/issues/34982
              mountPath: "/home/localdev/.ssh-egress"
              readOnly: true
            - name: user-gitconfig
              mountPath: "/home/localdev/.user-gitconfig"
              readOnly: true
            - name: r10k-config
              mountPath: "/etc/puppetlabs/r10k/r10k.yaml"
              readOnly: true
          resources:
            limits:
              memory: 2048Mi
              cpu: ".75"
            requests:
              memory: 1024Mi
              cpu: ".75"
        - name: puppet-ubuntu-focal
          image: devpod-puppet-ubuntu:focal
          # https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
          imagePullPolicy: Never
          env:
          - name: SECRET_CONTROL_REPO_URL
            valueFrom:
              secretKeyRef:
                name: git-remotes
                key: control-repo  
          # https://github.com/kubernetes/kubernetes/issues/34982
          lifecycle:
            postStart:
              exec:
                command:
                  - /usr/bin/bash
                  - -c
                  - /usr/bin/cp -aL /home/localdev/.user-gitconfig/.gitconfig /home/localdev/.gitconfig && /usr/bin/mkdir -p /home/localdev/.ssh && /usr/bin/chmod 700 /home/localdev/.ssh && /usr/bin/cp -aL /home/localdev/.ssh-egress/* /home/localdev/.ssh && /usr/bin/chmod 600 /home/localdev/.ssh/id_ed25519 && /usr/bin/chmod 644 /home/localdev/.ssh/known_hosts /home/localdev/.ssh/id_ed25519.pub
          securityContext:
            runAsUser: 33333
            runAsGroup: 33333
            capabilities:
              add:
                - NET_ADMIN
                - SYS_PTRACE
          command: ["tail", "-f", "/dev/null"]
          volumeMounts:
            - name: workspaces
              mountPath: /workspace
            # - mountPath: /workspace
            #   name: code-volume
            - mountPath: /home/localdev/.cache
              name: cache-volume
              readOnly: true
            - name: ssh-egress
              # https://github.com/kubernetes/kubernetes/issues/34982
              mountPath: "/home/localdev/.ssh-egress"
              readOnly: true
            - name: user-gitconfig
              mountPath: "/home/localdev/.user-gitconfig"
              readOnly: true
            - name: r10k-config
              mountPath: "/etc/puppetlabs/r10k/r10k.yaml"
              readOnly: true
          resources:
            limits:
              memory: 1024Mi
              cpu: ".4"
            requests:
              memory: 512Mi
              cpu: ".4"
      volumes:
        - name: workspaces
          persistentVolumeClaim:
            claimName: workspaces
        # - name: code-volume
        #   hostPath:
        #     # LINUX/MACOS: location of repo on the host we're launching from:
        #     path: .
        #     # WINDOWS: it's COMPLICATED:
        #     # - bind mount on the WSL2 image:
        #     #    sudo mount --bind /blah/blah/dbwriter_python /mnt/wsl/dbwriter_python
        #     # - this maps to:
        #     #   /run/desktop/mnt/host/wsl/... for docker and kubernetes
        #     #   see https://github.com/docker/for-win/issues/5325#issuecomment-567594291
        #     #   (on docker-desktop wsl2 image, I can only see it as /mnt/host/wsl/... )
        #     #path: /run/desktop/mnt/host/wsl/dbwriter_python
        #     # this field is optional
        #     type: Directory
        - name: cache-volume
          # https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
          # same as lifetime of the pod; OK for caching of package installs and so on
          emptyDir: {}
        - name: ssh-egress
          secret:
            secretName: ssh-egress
            defaultMode: 0600
            items:
              - key: id_ed25519
                path: id_ed25519
              - key: id_ed25519.pub
                path: id_ed25519.pub
              - key: known_hosts
                path: known_hosts
        - name: eyaml-keys
          secret:
            secretName: eyaml-keys
            defaultMode: 0640
            items:
              - key: private_key.pkcs7.pem
                path: private_key.pkcs7.pem
              - key: public_key.pkcs7.pem
                path: public_key.pkcs7.pem
        - name: user-gitconfig
          configMap:
            name: user-gitconfig
        - name: r10k-config
          configMap:
            name: r10k-config