apiVersion: apps/v1
kind: Deployment
metadata:
  name: beer-deployment
  namespace: beer
  labels:
    app: beer-data
spec:
  replicas: 3
  selector:
    matchLabels:
      app: beer-data
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: beer-data
    spec:
      securityContext:
        # Pod-level: only runAsNonRoot/runAsUser/runAsGroup/fsGroup belong
        # here.  allowPrivilegeEscalation and capabilities are container-level.
        runAsNonRoot: true
        runAsUser: 999
        runAsGroup: 999
        fsGroup: 999
      containers:
        - name: beer-data
          image: git.aridgwayweb.com/armistace/beer-data:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 5000
              protocol: TCP
          env:
            - name: MONGO_HOST
              value: "192.168.178.229"
            - name: MONGO_USER
              value: "root"
            # MONGO_PASS and SECRET_KEY come from the live Secret - they are
            # deliberately NOT in this file.  See RUNBOOK.md.
            - name: MONGO_PASS
              valueFrom:
                secretKeyRef:
                  name: beer-db
                  key: mongo_pass
            - name: SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: beer-app
                  key: secret_key
          resources:
            limits:
              cpu: 200m
              memory: 256Mi
            requests:
              cpu: 50m
              memory: 64Mi
          securityContext:
            # Container-level: these two belong here, not on the pod.
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          livenessProbe:
            httpGet:
              path: /healthz
              port: 5000
            initialDelaySeconds: 10
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /readyz
              port: 5000
            initialDelaySeconds: 5
            periodSeconds: 10
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}
      nodeSelector:
        kubernetes.io/hostname: archlinux-k3s-3
      imagePullSecrets:
        - name: beercred
      terminationGracePeriodSeconds: 30
      restartPolicy: Always