---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: repospawner
  namespace: repospawner
  annotations:
    secret.reloader.stakater.com/reload: "repospawner-woodpecker"
spec:
  # Request state lives in memory and is rebuilt from Job labels on startup, so
  # exactly one replica may exist at a time.
  replicas: 1
  selector:
    matchLabels:
      app: repospawner
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: repospawner
    spec:
      serviceAccountName: repospawner
      automountServiceAccountToken: true
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: repospawner
          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.0
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8080
              name: http
              protocol: TCP
          env:
            - name: REPOSPAWNER_NAMESPACE
              value: repospawner
            # The server passes its own image down to the Jobs, so this must
            # match the image above exactly.
            - name: REPOSPAWNER_IMAGE
              value: artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.0
            - name: REPOSPAWNER_JOB_SERVICE_ACCOUNT
              value: repospawner
            - name: GITEA_URL
              value: https://git.unkin.net
            - name: REPOSPAWNER_TFGIT_REPO
              value: unkin/terraform-git
            - name: VAULT_ADDR
              value: https://vault.service.consul:8200
            - name: WOODPECKER_SERVER
              value: https://ci.k8s.syd1.au.unkin.net
            # Name only: the enablement Job mounts this Secret itself.
            - name: REPOSPAWNER_WOODPECKER_SECRET
              value: repospawner-woodpecker
            - name: REPOSPAWNER_WOODPECKER_TOKEN_FILE
              value: /etc/repospawner/woodpecker/token
            # oauth2-proxy --pass-user-headers forwards the Authentik groups as a
            # comma-joined X-Forwarded-Groups; X-Auth-Request-Groups is
            # auth_request-response-only and never reaches a proxied upstream.
            - name: REPOSPAWNER_GROUPS_HEADER
              value: X-Forwarded-Groups
            - name: REPOSPAWNER_ALLOWED_GROUPS
              value: akP-repospawner-admin
          volumeMounts:
            - name: vault-token
              mountPath: /var/run/secrets/vault
              readOnly: true
            - name: woodpecker-token
              mountPath: /etc/repospawner/woodpecker
              readOnly: true
          livenessProbe:
            httpGet:
              path: /livez
              port: http
            initialDelaySeconds: 10
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /readyz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 300m
              memory: 256Mi
      volumes:
        # Native Vault kubernetes login: the default kubernetes.io token has the
        # wrong audience, so the app reads this audience-vault projection.
        - name: vault-token
          projected:
            sources:
              - serviceAccountToken:
                  path: token
                  audience: vault
                  expirationSeconds: 600
        # Optional: absent, the server starts and refuses woodpecker requests.
        - name: woodpecker-token
          secret:
            secretName: repospawner-woodpecker
            optional: true
            items:
              - key: token
                path: token
      restartPolicy: Always