apiVersion: apps/v1
kind: Deployment
metadata:
  name: dbaas-ui
  labels:
    app.kubernetes.io/name: dbaas-ui
    app.kubernetes.io/part-of: dbaas-ui
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: dbaas-ui
  template:
    metadata:
      labels:
        app.kubernetes.io/name: dbaas-ui
        app.kubernetes.io/part-of: dbaas-ui
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
        seccompProfile:
          type: RuntimeDefault
      imagePullSecrets:
        - name: cp9-staging-ecr-pull
      containers:
        - name: dbaas-ui
          # Human promotion replaces this fail-closed value with the validated
          # account-414 candidate digest. Mutable tags are never accepted.
          image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/cp9-dbaas-ui@sha256:eabb15385b980dea87f0d31509ea8baf43d595887d987d6bc21cc9301f0b31d0
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 2
            timeoutSeconds: 2
            failureThreshold: 15
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              cpu: 500m
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
              # The upstream Caddy binary carries the low-port file capability.
              # Keep that single capability in the container bounding set so
              # Linux can exec it under no-new-privileges; Caddy still listens
              # only on the unprivileged port 8080 in this image.
              add:
                - NET_BIND_SERVICE
          volumeMounts:
            - name: runtime-config
              mountPath: /srv/config.js
              subPath: config.js
              readOnly: true
            - name: caddy-data
              mountPath: /data
            - name: caddy-config
              mountPath: /config
      volumes:
        - name: runtime-config
          configMap:
            name: dbaas-ui-runtime
            items:
              - key: config.js
                path: config.js
        - name: caddy-data
          emptyDir: {}
        - name: caddy-config
          emptyDir: {}