apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ .Chart.Name }}
      app.kubernetes.io/instance: {{ .Release.Name }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ .Chart.Name }}
        app.kubernetes.io/instance: {{ .Release.Name }}
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      dnsPolicy: None
      dnsConfig:
        nameservers: {{ .Values.dnsServers | toJson }}
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        # Only this offline copy runs as root to read the upstream /root tree.
        # The browser and Java never run as root. No downloads or custom image.
        - name: prepare-novnc
          image: docker.io/solarkennedy/ipmi-kvm-docker:{{ .Chart.AppVersion }}
          imagePullPolicy: IfNotPresent
          command: [/bin/sh, -ec]
          args:
            - cp -R /root/novnc /opt/novnc/site; chmod -R a+rX /opt/novnc/site
          securityContext:
            runAsUser: 0
            runAsNonRoot: false
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ALL]
          volumeMounts:
            - name: novnc
              mountPath: /opt/novnc
      containers:
        - name: browser
          image: docker.io/solarkennedy/ipmi-kvm-docker:{{ .Chart.AppVersion }}
          imagePullPolicy: IfNotPresent
          workingDir: /home/ipmi
          command: [/usr/bin/supervisord, -c, /etc/oldipmi/supervisord.conf]
          env:
            - name: HOME
              value: /home/ipmi
            - name: RES
              value: {{ .Values.resolution | quote }}
            - name: PYTHONDONTWRITEBYTECODE
              value: '1'
          ports:
            - name: http
              containerPort: 8080
          startupProbe:
            httpGet: {path: /vnc.html, port: http}
            failureThreshold: 30
            periodSeconds: 5
          readinessProbe:
            httpGet: {path: /vnc.html, port: http}
          livenessProbe:
            httpGet: {path: /vnc.html, port: http}
            periodSeconds: 20
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ALL]
          resources:
{{ toYaml .Values.resources | indent 12 }}
          volumeMounts:
            - name: config
              mountPath: /etc/oldipmi
              readOnly: true
            - name: novnc
              mountPath: /opt/novnc
              readOnly: true
            - name: home
              mountPath: /home/ipmi
            - name: tmp
              mountPath: /tmp
            - name: shm
              mountPath: /dev/shm
      volumes:
        - name: config
          configMap:
            name: {{ .Release.Name }}
        - name: novnc
          emptyDir: {sizeLimit: 32Mi}
        - name: home
          emptyDir: {sizeLimit: 1Gi}
        - name: tmp
          emptyDir: {sizeLimit: 256Mi}
        - name: shm
          emptyDir: {medium: Memory, sizeLimit: 128Mi}