apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: backend
    app.kubernetes.io/name: api
    app.kubernetes.io/part-of: develocity-provenance-governor
    app.kubernetes.io/version: 1.6.0
  name: api
  namespace: develocity-provenance-governor
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: backend
    app.kubernetes.io/name: api
    app.kubernetes.io/part-of: develocity-provenance-governor
    app.kubernetes.io/version: 1.6.0
  name: api-http
  namespace: develocity-provenance-governor
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: http
  selector:
    app.kubernetes.io/component: backend
    app.kubernetes.io/name: api
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: backend
    app.kubernetes.io/name: api
    app.kubernetes.io/part-of: develocity-provenance-governor
    app.kubernetes.io/version: 1.6.0
  name: api-http-monitoring
  namespace: develocity-provenance-governor
spec:
  ports:
  - name: http-monitoring
    port: 9090
    protocol: TCP
    targetPort: http-monitoring
  selector:
    app.kubernetes.io/component: backend
    app.kubernetes.io/name: api
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: backend
    app.kubernetes.io/name: api
    app.kubernetes.io/part-of: develocity-provenance-governor
    app.kubernetes.io/version: 1.6.0
  name: api
  namespace: develocity-provenance-governor
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: backend
      app.kubernetes.io/name: api
  template:
    metadata:
      labels:
        app.kubernetes.io/component: backend
        app.kubernetes.io/name: api
    spec:
      containers:
      - image: registry.gradle.com/develocity/provenance-governor:1.6.0@sha256:8c1c31104a21e00dbedabfa5aa26189b4a94fbd03d81ad23f65f06a8dbde5297
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /actuator/health/liveness
            port: 9090
        name: api-http
        ports:
        - containerPort: 8080
          name: http
        - containerPort: 9090
          name: http-monitoring
        readinessProbe:
          httpGet:
            path: /actuator/health/readiness
            port: 9090
        resources:
          limits:
            cpu: 2000m
            memory: 1Gi
          requests:
            cpu: 2000m
            memory: 1Gi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /tmp
          name: tmp
        - mountPath: /workspace/config/license
          name: license
          readOnly: true
        - mountPath: /workspace/config/secrets
          name: secrets
          readOnly: true
        - mountPath: /workspace/config/policies
          name: policies
          readOnly: true
        - mountPath: /workspace/config/properties
          name: properties
          readOnly: true
      imagePullSecrets:
      - name: registry-secret
      securityContext:
        fsGroup: 65534
        fsGroupChangePolicy: Always
        runAsGroup: 65534
        runAsNonRoot: true
        runAsUser: 65534
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: api
      volumes:
      - emptyDir: {}
        name: tmp
      - name: license
        secret:
          optional: true
          secretName: license
      - name: secrets
        secret:
          optional: true
          secretName: secrets
      - configMap:
          name: policies
          optional: true
        name: policies
      - configMap:
          name: properties
          optional: true
        name: properties
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/component: backend
    app.kubernetes.io/name: api
    app.kubernetes.io/part-of: develocity-provenance-governor
    app.kubernetes.io/version: 1.6.0
  name: api
  namespace: develocity-provenance-governor
spec:
  ingress:
  - from:
    - namespaceSelector: {}
      podSelector: {}
    ports:
    - port: 8080
      protocol: TCP
  podSelector:
    matchLabels:
      app.kubernetes.io/component: backend
      app.kubernetes.io/name: api
  policyTypes:
  - Ingress
