---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kwir
  namespace: kwir
  labels:
    app: kwir
spec:
  replicas: 2
  selector:
    matchLabels:
      app: kwir
  template:
    metadata:
      labels:
        app: kwir
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 50
            podAffinityTerm:
              topologyKey: "kubernetes.io/hostname"
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - kwir
      securityContext:
        runAsUser: 65532
      terminationGracePeriodSeconds: 10
      containers:
      - name: kwir
        image: barthv/kwir:v0.1.0
        imagePullPolicy: IfNotPresent
        securityContext:
          allowPrivilegeEscalation: false
        ports:
        - name: checks-http
          containerPort: 9080
        - name: https
          containerPort: 9443
        - name: metrics
          containerPort: 8080
        livenessProbe:
          httpGet:
            path: /healthz
            port: checks-http
          initialDelaySeconds: 15
          periodSeconds: 20
        readinessProbe:
          httpGet:
            path: /readyz
            port: checks-http
          initialDelaySeconds: 5
          periodSeconds: 10
        volumeMounts:
        - mountPath: /certs
          name: certs
        - mountPath: /configs
          name: configs
        resources:
          limits:
            cpu: 20m
            memory: 32Mi
      volumes:
      - name: certs
        secret:
          secretName: kube-webhook-img-rewriter-certs
      - name: configs
        configMap:
          name: kwir-configs
