apiVersion: apps/v1
kind: Deployment
metadata:
  name: proxy-gateway
  namespace: proxy-pool
  labels: {app.kubernetes.io/name: proxy-gateway, app.kubernetes.io/part-of: proxy-pool}
spec:
  replicas: 6
  minReadySeconds: 10
  revisionHistoryLimit: 3
  strategy:
    type: RollingUpdate
    rollingUpdate: {maxUnavailable: 1, maxSurge: 2}
  selector:
    matchLabels: {app.kubernetes.io/name: proxy-gateway}
  template:
    metadata:
      labels: {app.kubernetes.io/name: proxy-gateway, app.kubernetes.io/part-of: proxy-pool}
      annotations: {prometheus.io/scrape: "true", prometheus.io/port: "9090", prometheus.io/path: /metrics}
    spec:
      serviceAccountName: proxy-pool
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 60
      securityContext: {runAsNonRoot: true, seccompProfile: {type: RuntimeDefault}}
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector: {matchLabels: {app.kubernetes.io/name: proxy-gateway}}
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector: {matchLabels: {app.kubernetes.io/name: proxy-gateway}}
      containers:
        - name: gateway
          image: REGISTRY/proxy-pool:VERSION
          imagePullPolicy: IfNotPresent
          command: [proxy-gateway]
          env:
            - {name: PROXY_POOL_CONFIG, value: /etc/proxy-pool/config.yaml}
          envFrom:
            - secretRef: {name: proxy-pool-secrets}
          ports:
            - {name: proxy, containerPort: 8080, protocol: TCP}
            - {name: metrics, containerPort: 9090, protocol: TCP}
          readinessProbe:
            httpGet: {path: /readyz, port: metrics}
            periodSeconds: 3
            timeoutSeconds: 1
            failureThreshold: 3
          livenessProbe:
            httpGet: {path: /livez, port: metrics}
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3
          startupProbe:
            httpGet: {path: /livez, port: metrics}
            periodSeconds: 2
            failureThreshold: 30
          lifecycle:
            preStop: {exec: {command: [sh, -c, "sleep 5"]}}
          resources:
            requests: {cpu: "2", memory: 1Gi}
            limits: {cpu: "4", memory: 2Gi}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: [ALL]}
          volumeMounts:
            - {name: config, mountPath: /etc/proxy-pool, readOnly: true}
            - {name: tmp, mountPath: /tmp}
      volumes:
        - name: config
          configMap: {name: proxy-pool-config}
        - name: tmp
          emptyDir: {sizeLimit: 64Mi}
---
apiVersion: v1
kind: Service
metadata:
  name: proxy-gateway
  namespace: proxy-pool
  labels: {app.kubernetes.io/name: proxy-gateway}
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: nlb
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  selector: {app.kubernetes.io/name: proxy-gateway}
  ports:
    - {name: proxy, port: 8080, targetPort: proxy, protocol: TCP}