apiVersion: apps/v1
kind: Deployment
metadata:
  name: beer-deployment
  namespace: beer
  labels:
    app: beer-data
spec:
  replicas: 3
  selector:
    matchLabels:
      app: beer-data
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: beer-data
    spec:
      containers:
        - name: beer-data
          # The image tag is pinned to the commit SHA by CI (`kubectl set
          # image`).  The value here is a sentinel: applying the manifest
          # as-is would leave the deployment on that sentinel, so CI always
          # replaces it before rolling.  It is deliberately NOT `:latest` —
          # a mutable tag makes the rollout a no-op (the pod template does not
          # change) and makes `rollout undo` meaningless.
          image: git.aridgwayweb.com/armistace/beer-data:SET_BY_CI
          imagePullPolicy: Always
          ports:
            - containerPort: 5000
              protocol: TCP
          env:
            - name: MONGO_HOST
              value: "192.168.178.229"
            - name: MONGO_USER
              value: "root"
            # MONGO_PASS and SECRET_KEY come from the live Secret - they are
            # deliberately NOT in this file.  See RUNBOOK.md.
            - name: MONGO_PASS
              valueFrom:
                secretKeyRef:
                  name: beer-db
                  key: mongo_pass
            - name: SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: beer-app
                  key: secret_key
          resources:
            limits:
              cpu: 200m
              memory: 256Mi
            requests:
              cpu: 50m
              memory: 64Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            # The app reads its own source and talks to Mongo over the
            # network.  It writes no files, so the root filesystem can be
            # read-only.  /tmp is still writable via the emptyDir below.
            readOnlyRootFilesystem: true
          livenessProbe:
            httpGet:
              path: /healthz
              port: 5000
            initialDelaySeconds: 10
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /readyz
              port: 5000
            initialDelaySeconds: 5
            periodSeconds: 10
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}
      securityContext:
        runAsNonRoot: true
        # The image creates a named user "beer".  kubelet cannot verify that a
        # *named* user is non-root (it can only check a numeric UID), so the
        # UID is set explicitly here.  It must match the UID in the image.
        runAsUser: 999
        runAsGroup: 999
        fsGroup: 999
      nodeSelector:
        kubernetes.io/hostname: archlinux-k3s-3
      imagePullSecrets:
        - name: beercred
      terminationGracePeriodSeconds: 30
      restartPolicy: Always