apiVersion: v1
kind: ServiceAccount
metadata:
  name: dataops-runtime
  namespace: {{ .Values.namespace }}
automountServiceAccountToken: false
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dataops-backend
  namespace: {{ .Values.namespace }}
spec:
  replicas: {{ .Values.replicas.backend }}
  selector: {matchLabels: {app: dataops-backend}}
  template:
    metadata: {labels: {app: dataops-backend}}
    spec:
      serviceAccountName: dataops-runtime
      automountServiceAccountToken: false
      securityContext: {seccompProfile: {type: RuntimeDefault}}
      topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: DoNotSchedule
        labelSelector: {matchLabels: {app: dataops-backend}}
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector: {matchLabels: {app: dataops-backend}}
            topologyKey: kubernetes.io/hostname
      containers:
      - name: backend
        image: "{{ .Values.images.backend }}"
        securityContext:
          runAsNonRoot: true
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities: {drop: ["ALL"]}
        env:
        - name: DATABASE_URL
          valueFrom: {secretKeyRef: {name: "{{ .Values.secrets.database }}", key: url}}
        resources:
{{ toYaml .Values.resources | nindent 10 }}
        ports: [{containerPort: 5500}]
        readinessProbe: {httpGet: {path: /health, port: 5500}}
        livenessProbe: {httpGet: {path: /health, port: 5500}}
        startupProbe: {httpGet: {path: /health, port: 5500}, failureThreshold: 30, periodSeconds: 5}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dataops-runner
  namespace: {{ .Values.namespace }}
spec:
  replicas: {{ .Values.replicas.runner }}
  selector: {matchLabels: {app: dataops-runner}}
  template:
    metadata: {labels: {app: dataops-runner}}
    spec:
      serviceAccountName: dataops-runtime
      automountServiceAccountToken: false
      securityContext: {seccompProfile: {type: RuntimeDefault}}
      topologySpreadConstraints: [{maxSkew: 1, topologyKey: topology.kubernetes.io/zone, whenUnsatisfiable: DoNotSchedule, labelSelector: {matchLabels: {app: dataops-runner}}}]
      affinity: {podAntiAffinity: {requiredDuringSchedulingIgnoredDuringExecution: [{labelSelector: {matchLabels: {app: dataops-runner}}, topologyKey: kubernetes.io/hostname}]}}
      containers:
      - name: runner
        image: "{{ .Values.images.runner }}"
        securityContext: {runAsNonRoot: true, allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: {drop: ["ALL"]}}
        env: [{name: DATABASE_URL, valueFrom: {secretKeyRef: {name: "{{ .Values.secrets.database }}", key: url}}}]
        resources:
{{ toYaml .Values.resources | nindent 10 }}
        readinessProbe: {httpGet: {path: /health, port: 5600}}
        livenessProbe: {httpGet: {path: /health, port: 5600}}
        startupProbe: {httpGet: {path: /health, port: 5600}, failureThreshold: 30, periodSeconds: 5}