apiVersion: apps/v1
kind: Deployment
metadata:
  name: devops-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: devops-server
  template:
    metadata:
      labels:
        app: devops-server
    spec:
      serviceAccountName: devops-server-sa
      containers:
      - name: devops-server
        image: pingcap/devops-image:latest
        command:
          - /devops-server
          - --config=/etc/config/config.yaml
        volumeMounts:
          - name: config
            mountPath: /etc/config
          - name: jump-roles
            mountPath: /etc/jump-roles
          - name: gcp
            mountPath: /.gcp
          - name: federated-tokens
            mountPath: /var/run/secrets/federated-tokens
          - name: external-logs
            mountPath: /var/log/devops-server
        resources:
          limits:
            cpu: 100m
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 500Mi
        env:
          - name: GOOGLE_APPLICATION_CREDENTIALS
            value: /.gcp/credentials.json
      - name: access-log-tailer
        image: gcr.io/pingcap-public/dbaas/busybox:1.31.1
        command:
          - /bin/sh
          - -c
          - tail -F /var/log/devops-server/access.log 2>/dev/null
        volumeMounts:
          - name: external-logs
            mountPath: /var/log/devops-server
        resources:
          limits:
            cpu: 50m
            memory: 50Mi
      volumes:
        - name: config
          configMap:
            name: devops-server-config
        - name: jump-roles
          configMap:
            name: devops-server-jump-roles
        - name: gcp
          secret:
            secretName: devops-gcp-sa
        - name: federated-tokens
          projected:
            sources:
            # used to exchange Azure Managed Identity Token.
            - serviceAccountToken:
                path: token-azure
                expirationSeconds: 86400  # max limit is 24 hours.
                audience: api://AzureADTokenExchange
            # used to exchange AliCloud RAM Role ARN Token.
            - serviceAccountToken:
                path: token-alicloud
                audience: sts.aliyuncs.com
        - name: external-logs
          emptyDir: {}
      securityContext:
        fsGroup: 65534