---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: image-keeper
  namespace: artifactapi
spec:
  selector:
    matchLabels:
      app: image-keeper
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: image-keeper
    spec:
      automountServiceAccountToken: false
      priorityClassName: low
      tolerations:
        - operator: Exists
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        # artifactapi is distroless with no exit-0 flag, so run a static busybox as `true`
        - name: copy-true
          image: busybox:1.37.0-musl
          imagePullPolicy: IfNotPresent
          command: ["cp", "/bin/busybox", "/keeper/true"]
          volumeMounts:
            - name: keeper
              mountPath: /keeper
          resources:
            limits:
              cpu: 10m
              memory: 16Mi
            requests:
              cpu: 1m
              memory: 4Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
        - name: api
          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.13.1
          imagePullPolicy: IfNotPresent
          command: ["/keeper/true"]
          volumeMounts:
            - name: keeper
              mountPath: /keeper
              readOnly: true
          resources:
            limits:
              cpu: 10m
              memory: 16Mi
            requests:
              cpu: 1m
              memory: 4Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
        - name: ui
          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.13.1
          imagePullPolicy: IfNotPresent
          command: ["true"]
          resources:
            limits:
              cpu: 10m
              memory: 16Mi
            requests:
              cpu: 1m
              memory: 4Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
      containers:
        - name: pause
          image: rancher/mirrored-pause:3.6
          imagePullPolicy: IfNotPresent
          resources:
            limits:
              cpu: 10m
              memory: 16Mi
            requests:
              cpu: 1m
              memory: 4Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
      volumes:
        - name: keeper
          emptyDir: {}