apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Chart.Name }}
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "app.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.app.replicas }}
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  selector:
    matchLabels:
      {{- include "app.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "app.selectorLabels" . | nindent 8 }}
    spec:
      {{- with .Values.app.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      securityContext:
        runAsUser: {{ .Values.app.securityContext.runAsUser }}
        runAsGroup: {{ .Values.app.securityContext.runAsGroup }}
        runAsNonRoot: true
        fsGroup: {{ .Values.app.securityContext.runAsGroup }}
      containers:
        - name: web
          image: {{ .Values.app.image | quote }}
          imagePullPolicy: {{ .Values.app.imagePullPolicy | default "Always" }}
          ports:
            - containerPort: {{ .Values.app.port }}
              protocol: TCP
          envFrom:
            - configMapRef:
                name: {{ .Chart.Name }}-config
            - secretRef:
                name: {{ .Chart.Name }}-secret
          livenessProbe:
            httpGet:
              path: {{ .Values.app.probes.liveness.path }}
              port: {{ .Values.app.port }}
            initialDelaySeconds: {{ .Values.app.probes.liveness.initialDelaySeconds }}
            periodSeconds: {{ .Values.app.probes.liveness.periodSeconds }}
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: {{ .Values.app.probes.readiness.path }}
              port: {{ .Values.app.port }}
            initialDelaySeconds: {{ .Values.app.probes.readiness.initialDelaySeconds }}
            periodSeconds: {{ .Values.app.probes.readiness.periodSeconds }}
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            {{- toYaml .Values.app.resources | nindent 12 }}
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}