apiVersion: apps/v1
kind: Deployment
metadata:
  name: pinniped-concierge
  namespace: platform
  labels:
    app: pinniped-concierge
spec:
  replicas: 2
  selector:
    matchLabels:
      app: pinniped-concierge
  template:
    metadata:
      labels:
        app: pinniped-concierge
        deployment.pinniped.dev: concierge
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ""
    spec:
      securityContext:
        runAsUser: 1001
        runAsGroup: 1001
      serviceAccountName: pinniped-concierge
      imagePullSecrets:
        - name: management-acr
      nodeSelector:
        name: system
      priorityClassName: system-cluster-critical
      containers:
        - name: pinniped-concierge
          image: opsteadyos.azurecr.io/pinniped/pinniped-server:v0.12.0
          imagePullPolicy: IfNotPresent
          securityContext:
            readOnlyRootFilesystem: true
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 100m
              memory: 128Mi
          command:
            - pinniped-concierge
            - --config=/etc/config/pinniped.yaml
            - --downward-api-path=/etc/podinfo
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            - name: config-volume
              mountPath: /etc/config
              readOnly: true
            - name: podinfo
              mountPath: /etc/podinfo
              readOnly: true
            - name: impersonation-proxy
              mountPath: /var/run/secrets/impersonation-proxy.concierge.pinniped.dev/serviceaccount
              readOnly: true
          env: []
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8443
              scheme: HTTPS
            initialDelaySeconds: 2
            timeoutSeconds: 15
            periodSeconds: 10
            failureThreshold: 5
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8443
              scheme: HTTPS
            initialDelaySeconds: 2
            timeoutSeconds: 3
            periodSeconds: 10
            failureThreshold: 3
      volumes:
        - name: tmp
          emptyDir:
            medium: Memory
            sizeLimit: 100Mi
        - name: config-volume
          configMap:
            name: pinniped-concierge-config
        - name: impersonation-proxy
          secret:
            secretName: pinniped-concierge-impersonation-proxy
            items:
              - key: token
                path: token
        - name: podinfo
          downwardAPI:
            items:
              - path: labels
                fieldRef:
                  fieldPath: metadata.labels
              - path: name
                fieldRef:
                  fieldPath: metadata.name
              - path: namespace
                fieldRef:
                  fieldPath: metadata.namespace
      tolerations:
        - key: CriticalAddonsOnly
          operator: Exists
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 50
              podAffinityTerm:
                labelSelector:
                  matchLabels:
                    deployment.pinniped.dev: concierge
                topologyKey: kubernetes.io/hostname
