apiVersion: apps/v1
kind: Deployment
metadata:
  name: flex-auth-user-engine
  namespace: flex-auth
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: flex-auth-user-engine
  template:
    metadata:
      labels:
        app.kubernetes.io/name: flex-auth-user-engine
    spec:
      automountServiceAccountToken: false
      serviceAccountName: flex-auth-user-engine
      containers:
      - args:
        - serve
        - --addr
        - 0.0.0.0:8080
        - --registry
        - /opt/flex-auth/examples/user-engine/registry_snapshot.json
        - --policy
        - /opt/flex-auth/examples/user-engine/policy_package.md
        - --caller-auth-mode
        - warn
        - --caller-kubernetes-url
        - https://10.43.0.1
        - --caller-binding
        - user-engine=system:serviceaccount:user-engine:user-engine
        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
        livenessProbe:
          httpGet:
            path: /healthz
            port: http
          periodSeconds: 20
        name: flex-auth
        ports:
        - containerPort: 8080
          name: http
        readinessProbe:
          httpGet:
            path: /healthz
            port: http
          periodSeconds: 5
        resources:
          limits:
            cpu: 300m
            memory: 192Mi
          requests:
            cpu: 25m
            memory: 32Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /var/run/secrets/flex-auth-reviewer
          name: flex-auth-reviewer
          readOnly: true
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      volumes:
      - name: flex-auth-reviewer
        projected:
          defaultMode: 0440
          sources:
          - serviceAccountToken:
              audience: https://kubernetes.default.svc
              expirationSeconds: 3600
              path: token
          - configMap:
              items:
              - key: ca.crt
                path: ca.crt
              name: kube-root-ca.crt
---
apiVersion: v1
kind: Service
metadata:
  name: flex-auth-user-engine
  namespace: flex-auth
spec:
  ports:
  - name: http
    port: 8080
    targetPort: http
  selector:
    app.kubernetes.io/name: flex-auth-user-engine
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: flex-auth-user-engine
  namespace: flex-auth
spec:
  egress:
  - ports:
    - port: 443
      protocol: TCP
    - port: 6443
      protocol: TCP
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: user-engine
      podSelector:
        matchLabels:
          app.kubernetes.io/name: user-engine
    ports:
    - port: 8080
      protocol: TCP
  podSelector:
    matchLabels:
      app.kubernetes.io/name: flex-auth-user-engine
  policyTypes:
  - Ingress
  - Egress