apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: traefik-ai
spec:
  controller: traefik.io/ingress-controller
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ai
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: traefik-ai
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - secrets
      - endpoints
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingresses/status
    verbs:
      - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: traefik-ai
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: traefik-ai
subjects:
  - kind: ServiceAccount
    name: traefik-ai
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: firefly-traefik-ai
rules:
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingressclasses
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: firefly-traefik-ai
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: firefly-traefik-ai
subjects:
  - kind: ServiceAccount
    name: traefik-ai
    namespace: firefly-iii
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: traefik-ai
  labels:
    app.kubernetes.io/name: traefik-ai
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: traefik-ai
  template:
    metadata:
      labels:
        app.kubernetes.io/name: traefik-ai
    spec:
      serviceAccountName: traefik-ai
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      nodeSelector:
        kubernetes.io/hostname: ai.tail2fe2d.ts.net
      tolerations:
        - key: workload
          operator: Equal
          value: ai
          effect: NoSchedule
      containers:
        - name: traefik
          image: rancher/mirrored-library-traefik:3.6.13
          imagePullPolicy: IfNotPresent
          args:
            - --entrypoints.web.address=192.168.1.117:80
            - --providers.kubernetesingress=true
            - --providers.kubernetesingress.namespaces=firefly-iii
            - --providers.kubernetesingress.ingressclass=traefik-ai
            - --providers.kubernetesingress.labelselector=firefly.hexor.cy/private-ai=true
            - --providers.kubernetescrd=false
            - --api.dashboard=false
            - --log.level=INFO
          ports:
            - name: web
              containerPort: 80
              hostPort: 80
              hostIP: 192.168.1.117
              protocol: TCP
          readinessProbe:
            tcpSocket:
              host: 192.168.1.117
              port: web
            periodSeconds: 10
          livenessProbe:
            tcpSocket:
              host: 192.168.1.117
              port: web
            periodSeconds: 30
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 500m
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
            readOnlyRootFilesystem: true
            runAsNonRoot: false
            runAsUser: 0
            runAsGroup: 0
      securityContext:
        seccompProfile:
          type: RuntimeDefault