# Static assets only; no API, uploads, credentials or outbound connections.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lesavka-av-observer
spec:
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels: {app: lesavka-av-observer}
  template:
    metadata:
      labels: {app: lesavka-av-observer}
    spec:
      automountServiceAccountToken: false
      nodeSelector:
        kubernetes.io/arch: arm64
        node-role.kubernetes.io/worker: "true"
      securityContext:
        runAsNonRoot: true
        runAsUser: 101
        runAsGroup: 101
        fsGroup: 101
        seccompProfile: {type: RuntimeDefault}
      containers:
        - name: static
          image: nginx:1.27.5-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
          command: [/usr/sbin/nginx]
          args: [-c, /etc/nginx/observer/nginx.conf, -g, "daemon off;"]
          ports: [{name: http, containerPort: 8080}]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: [ALL]}
          resources:
            requests: {cpu: 10m, memory: 16Mi}
            limits: {cpu: 100m, memory: 64Mi}
          readinessProbe:
            httpGet: {path: /lesavka-av-test/, port: http}
          livenessProbe:
            httpGet: {path: /lesavka-av-test/, port: http}
            initialDelaySeconds: 10
          volumeMounts:
            - {name: config, mountPath: /etc/nginx/observer, readOnly: true}
            - {name: assets, mountPath: /usr/share/nginx/html/lesavka-av-test, readOnly: true}
            - {name: tmp, mountPath: /tmp}
      volumes:
        - name: config
          configMap: {name: lesavka-av-observer-nginx}
        - name: assets
          configMap: {name: lesavka-av-observer-assets}
        - name: tmp
          emptyDir: {medium: Memory, sizeLimit: 8Mi}