# Render placeholders before use. Apply the migration Job first, wait for completion,
# then apply this file. See docs/deployment.md for IAM, secrets and ingress.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: meguri
  annotations:
    iam.gke.io/gcp-service-account: MEGURI_GSA@PROJECT_ID.iam.gserviceaccount.com
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: meguri-config
data:
  MEGURI_BIND: 0.0.0.0:3000
  MEGURI_PUBLIC_URL: https://meguri.example.internal
  MEGURI_ROLE: all
  MEGURI_SKIP_MIGRATIONS: "true"
  MEGURI_ALLOW_SIGNUP: "false"
  MEGURI_SEED_DEMO: "false"
  RUST_LOG: meguri=info,cot=warn
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: meguri
spec:
  replicas: 2
  selector:
    matchLabels: {app: meguri}
  template:
    metadata:
      labels: {app: meguri}
    spec:
      serviceAccountName: meguri
      terminationGracePeriodSeconds: 60
      securityContext:
        runAsNonRoot: true
        seccompProfile: {type: RuntimeDefault}
      initContainers:
        - name: cloud-sql-proxy
          restartPolicy: Always
          image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.14.1
          args: ["--private-ip", "--structured-logs", "--port=5432", "--health-check", "--http-address=0.0.0.0", "--http-port=9090", "PROJECT_ID:REGION:INSTANCE"]
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: {drop: [ALL]}
          resources:
            requests: {cpu: 100m, memory: 128Mi}
            limits: {memory: 256Mi}
          startupProbe:
            httpGet: {path: /startup, port: 9090}
            periodSeconds: 2
            failureThreshold: 30
      containers:
        - name: meguri
          image: REGION-docker.pkg.dev/PROJECT_ID/REPOSITORY/meguri:RELEASE
          ports: [{name: http, containerPort: 3000}]
          envFrom:
            - configMapRef: {name: meguri-config}
            - secretRef: {name: meguri-secrets}
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities: {drop: [ALL]}
          resources:
            requests: {cpu: 250m, memory: 256Mi}
            limits: {memory: 512Mi}
          startupProbe:
            httpGet: {path: /health/ready, port: http}
            periodSeconds: 2
            failureThreshold: 60
          readinessProbe:
            httpGet: {path: /health/ready, port: http}
          livenessProbe:
            httpGet: {path: /health/live, port: http}
---
apiVersion: v1
kind: Service
metadata:
  name: meguri
spec:
  type: ClusterIP
  selector: {app: meguri}
  ports: [{port: 80, targetPort: http}]
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: meguri
spec:
  minAvailable: 1
  selector:
    matchLabels: {app: meguri}