apiVersion: apps/v1
kind: StatefulSet
metadata:
  annotations:
    sidecar.jaegertracing.io/inject: jaeger
  name: dataflow-workflow
spec:
  replicas: 2
  serviceName: dataflow-workflow
  selector:
    matchLabels:
      app: dataflow-workflow
  template:
    metadata:
      labels:
        app: dataflow-workflow
    spec:
      containers:
        - args:
            - workflow
            - --config=/etc/dataflow/config.yaml
          command:
            - /dataflow
          image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/dbaas/dev/dataflow-service:9ace8c62aeb2ad14262fec5acb0379d129f3bcc1
          imagePullPolicy: IfNotPresent
          name: dataflow-workflow
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: GCP_WORKLOAD_IDENTITY_AUDIENCE # TODO remove GCP ENV
              value: "fake"
            - name: GCP_IMPERSONATE_SA
              value: "fake"
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /.gcp/credentials.json #  this secret is created by pulumi https://github.com/tidbcloud/dataflow-service/commit/46805530b58677a4a1da44a4ef4c503d5ff397bc
          readinessProbe:
            failureThreshold: 10
            initialDelaySeconds: 5
            periodSeconds: 5
            successThreshold: 1
            tcpSocket:
              port: 9090
            timeoutSeconds: 1
          volumeMounts:
            - mountPath: /etc/dataflow
              name: dataflow-config
              readOnly: true
            - mountPath: /.gcp
              name: gcp
      serviceAccountName: central
      volumes:
        - configMap:
            name: dataflow-conf
          name: dataflow-config
        - name: gcp
          secret:
            defaultMode: 420
            secretName: dataflow-gcp-secret