# SPDX-License-Identifier: MIT-0
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ the_button_name | to_json }}
  namespace: {{ the_button_namespace | to_json }}
  labels:
    app.kubernetes.io/name: the-button
    app.kubernetes.io/instance: {{ the_button_name | to_json }}
    app.kubernetes.io/managed-by: ansible
spec:
  # State is cached in-process and persisted to files; never run concurrent replicas.
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: the-button
      app.kubernetes.io/instance: {{ the_button_name | to_json }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: the-button
        app.kubernetes.io/instance: {{ the_button_name | to_json }}
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      terminationGracePeriodSeconds: 30
{% if the_button_image_pull_secrets | length > 0 %}
      imagePullSecrets:
{% for secret in the_button_image_pull_secrets %}
        - name: {{ secret | to_json }}
{% endfor %}
{% endif %}
      nodeSelector: {{ the_button_node_selector | to_json }}
      tolerations: {{ the_button_tolerations | to_json }}
      affinity: {{ the_button_affinity | to_json }}
      containers:
        - name: the-button
          image: {{ the_button_image | to_json }}
          imagePullPolicy: {{ the_button_image_pull_policy | to_json }}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ALL]
          ports:
            - name: http
              containerPort: 8000
              protocol: TCP
          env:
            - name: BUTTON_HOST
              value: "0.0.0.0"
            - name: BUTTON_PORT
              value: "8000"
            - name: BUTTON_DURATION_SECONDS
              value: {{ (the_button_duration_seconds | string) | to_json }}
            - name: BUTTON_DATA_FILE
              value: /data/data.json
            - name: BUTTON_MAILING_LIST_FILE
              value: /data/mailing_list.csv
            - name: PYTHONDONTWRITEBYTECODE
              value: "1"
          resources: {{ the_button_resources | to_json }}
          startupProbe:
            httpGet:
              path: /api/state
              port: http
            periodSeconds: 5
            timeoutSeconds: 5
            failureThreshold: 30
          readinessProbe:
            httpGet:
              path: /api/state
              port: http
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet:
              path: /api/state
              port: http
            periodSeconds: 20
            timeoutSeconds: 5
            failureThreshold: 3
          volumeMounts:
            - name: data
              mountPath: /data
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: {{ (the_button_existing_claim or (the_button_name ~ '-data')) | to_json }}
        - name: tmp
          emptyDir:
            sizeLimit: 64Mi