apiVersion: apps/v1
kind: Deployment
metadata:
  name: regional-server
  labels:
    app.kubernetes.io/name: regional-server
    app.kubernetes.io/component: regional-server
    app.kubernetes.io/managed-by: kustomize
spec:
  selector:
    matchLabels:
      app: regional-server
  replicas: {{ default 1 .Values.manager.replicas }}
  template:
    metadata:
      annotations:
        {{- $configDir := printf "configmap/config/%s_%s_%s" .Values.cloudProvider .Values.env .Values.region }}
        changesum/root-config: {{ .Files.Get (print $configDir "/root-config.yaml") | sha256sum }}
        changesum/k8s-addon-template: {{ .Files.Get (print $configDir "/k8s-addon-templates.yaml") | sha256sum }}
        changesum/k8s-dedicated-template: {{ .Files.Get (print $configDir "/k8s-dedicated-templates.yaml") | sha256sum }}
        changesum/k8s-infra-template: {{ .Files.Get (print $configDir "/k8s-infra-templates.yaml") | sha256sum }}
        changesum/k8s-dp-template: {{ .Files.Get (print $configDir "/k8s-dp-templates.yaml") | sha256sum }}
        kubectl.kubernetes.io/default-container: regional-server
      labels:
        app: regional-server
        {{- if eq .Values.cloudProvider "azure"}}
        azure.workload.identity/use: "true"
        {{- end }}
        cloud.pingcap.com/bizType: dedicated
        tags.tidbcloud.com/environment: {{ .Values.env }}
        tags.tidbcloud.com/servicetype: dedicated
        tags.tidbcloud.com/usedby: dbaas-control-plane-seed
    spec:
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
      - args:
        - --port=8080
        - --log-level=debug
        - --client-mode=true
        - --leader-elect=true
        - --root-config=/etc/configs/root-config.yaml
        - --addon-template-config=/etc/configs/k8s-addon-templates.yaml
        - --infra-template-config=/etc/configs/k8s-infra-templates.yaml
        - --dedicated-template-config=/etc/configs/k8s-dedicated-templates.yaml
        - --dp-template-config=/etc/configs/k8s-dp-templates.yaml
        {{- if ne .Values.cloudProvider "aws" }}
        env:
        - name: AWS_STS_REGIONAL_ENDPOINTS
          value: regional
        - name: AWS_REGION
          value: us-west-2
        # allowing assume to the specified aws role from gcp and azure
        - name: AWS_ROLE_ARN
          value: {{ .Values.manager.awsArn }}
        - name: AWS_WEB_IDENTITY_TOKEN_FILE
          value: /var/run/secrets/kubernetes.io/serviceaccount/token
        {{- end }}
        image: {{ .Values.manager.image }}
        name: regional-server
        ports:
        - containerPort: 8080
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - "ALL"
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 15
          periodSeconds: 20
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        imagePullPolicy: Always
        volumeMounts:
          - name: root-config
            mountPath: /etc/configs/root-config.yaml
            subPath: root-config.yaml
          - name: addon-template-config
            mountPath: /etc/configs/k8s-addon-templates.yaml
            subPath: k8s-addon-templates.yaml
          - name: infra-template-config
            mountPath: /etc/configs/k8s-infra-templates.yaml
            subPath: k8s-infra-templates.yaml
          - name: dedicated-template-config
            mountPath: /etc/configs/k8s-dedicated-templates.yaml
            subPath: k8s-dedicated-templates.yaml
          - name: dp-template-config
            mountPath: /etc/configs/k8s-dp-templates.yaml
            subPath: k8s-dp-templates.yaml
        {{- with .Values.manager.resources }}
        resources:
        {{- toYaml . | nindent 10}}
        {{- end }}
      volumes:
        - name: root-config
          configMap:
            name: regional-server-root-config
        - name: addon-template-config
          configMap:
            name: regional-server-addon-template-config
        - name: infra-template-config
          configMap:
            name: regional-server-infra-template-config
        - name: dedicated-template-config
          configMap:
            name: regional-server-dedicated-template-config
        - name: dp-template-config
          configMap:
            name: regional-server-dp-template-config
      serviceAccountName: dedicated-regional-server-manager
      terminationGracePeriodSeconds: 10