apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "appmesh-gateway.fullname" . }}
  labels:
{{ include "appmesh-gateway.labels" . | indent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ include "appmesh-gateway.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ include "appmesh-gateway.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name }}
        app.kubernetes.io/part-of: appmesh
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/path: "/stats/prometheus"
        prometheus.io/port: "8081"
        # exclude inbound traffic on port 8080
        appmesh.k8s.aws/ports: "444"
        # exclude egress traffic to xDS server and Kubernetes API
        appmesh.k8s.aws/egressIgnoredPorts: "18000,22,443"
        checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum | quote }}
    spec:
      serviceAccountName: {{ include "appmesh-gateway.serviceAccountName" . }}
      terminationGracePeriodSeconds: 45
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: {{ include "appmesh-gateway.name" . }}
                topologyKey: kubernetes.io/hostname
              weight: 100
      volumes:
      - name: appmesh-gateway-config
        configMap:
          name: {{ template "appmesh-gateway.fullname" . }}
      containers:
        - name: controller
          image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}"
          imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
          securityContext:
            readOnlyRootFilesystem: true
            runAsUser: 10001
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
          command:
            - ./flagger-appmesh-gateway
            - --opt-in={{ .Values.discovery.optIn }}
            - --gateway-mesh={{ .Values.mesh.name }}
            - --gateway-name=$(POD_SERVICE_ACCOUNT)
            - --gateway-namespace=$(POD_NAMESPACE)
          env:
            - name: POD_SERVICE_ACCOUNT
              valueFrom:
                fieldRef:
                  fieldPath: spec.serviceAccountName
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          ports:
            - name: grpc
              containerPort: 18000
              protocol: TCP
          livenessProbe:
            initialDelaySeconds: 5
            tcpSocket:
              port: grpc
          readinessProbe:
            initialDelaySeconds: 5
            tcpSocket:
              port: grpc
          resources:
            limits:
              memory: 1Gi
            requests:
              cpu: 10m
              memory: 32Mi
        - name: proxy
          image: "{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}"
          imagePullPolicy: {{ .Values.proxy.image.pullPolicy }}
          securityContext:
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
          args:
            - -c
            - /config/envoy.yaml
            - --service-cluster $(POD_NAMESPACE)
            - --service-node $(POD_NAME)
            - --log-level info
            - --base-id 1234
          ports:
            - name: admin
              containerPort: 8081
              protocol: TCP
            - name: http
              containerPort: 8080
              protocol: TCP
          livenessProbe:
            initialDelaySeconds: 5
            tcpSocket:
              port: admin
          readinessProbe:
            initialDelaySeconds: 5
            httpGet:
              path: /ready
              port: admin
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          volumeMounts:
            - name: appmesh-gateway-config
              mountPath: /config
          resources:
{{ toYaml .Values.resources | indent 12 }}
    {{- with .Values.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
    {{- end }}
