# VShell runtime, pulling the image from the internal ATT GitLab registry.
#
# Single replica: the daemons own fixed ports and one host key, so they are not
# horizontally scalable.
#
# This registry is outside OpenShift, so three things make the pull work:
#   1. 06-att-gitlab-pull-secret.yaml (credentials, linked via the ServiceAccount)
#   2. cluster/00-insecure-registry.yaml on the nodes - the registry equivalent
#      of `podman pull -k`, since a pod spec cannot opt out of TLS verification
#   3. DNS/route reachability of att-gitlab.apps.evd.geaerospace.net:5050 from
#      every node
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vshell
  namespace: vshell
  labels:
    app.kubernetes.io/name: vshell
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: vshell
  template:
    metadata:
      labels:
        app.kubernetes.io/name: vshell
    spec:
      serviceAccountName: vshell
      imagePullSecrets:
        - name: att-gitlab-pull
      securityContext:
        runAsUser: 0
        runAsGroup: 0
        fsGroup: 0
      containers:
        - name: vshell
          image: att-gitlab.apps.evd.geaerospace.net:5050/att/infrastructure/vshell:latest
          imagePullPolicy: Always
          env:
            - name: VSHELL_CONFIG
              value: /data/vshelld_config
            - name: VSHELL_TLS_P12
              value: /data/vshell-https.p12
          ports:
            - name: ssh
              containerPort: 22
              protocol: TCP
            - name: ftps
              containerPort: 21
              protocol: TCP
            - name: ftps-implicit
              containerPort: 990
              protocol: TCP
            - name: http
              containerPort: 80
              protocol: TCP
            - name: https
              containerPort: 443
              protocol: TCP
          volumeMounts:
            - name: data
              mountPath: /data
          readinessProbe:
            tcpSocket:
              port: ssh
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            tcpSocket:
              port: ssh
            initialDelaySeconds: 30
            periodSeconds: 20
          resources:
            requests:
              cpu: 250m
              memory: 512Mi
            limits:
              cpu: "2"
              memory: 2Gi
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: vshell-data