apiVersion: v1
kind: Namespace
metadata:
  name: playwright
  labels:
    app.kubernetes.io/part-of: rapp-playwright
    pod-security.kubernetes.io/enforce: restricted
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: playwright
  namespace: playwright
automountServiceAccountToken: false
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: playwright-artifacts
  namespace: playwright
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: local-path
  resources:
    requests:
      storage: 2Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: playwright
  namespace: playwright
  labels:
    app.kubernetes.io/name: playwright
    app.kubernetes.io/part-of: rapp-playwright
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: playwright
  template:
    metadata:
      labels:
        app.kubernetes.io/name: playwright
        app.kubernetes.io/part-of: rapp-playwright
    spec:
      serviceAccountName: playwright
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 15
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: service
          image: "${IMAGE_REFERENCE}"
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
          env:
            - {name: HOST, value: "127.0.0.1"}
            - {name: DATA_DIR, value: /data}
            - {name: EXECUTION_LOCATION, value: railiance01/playwright}
            - {name: RELEASE_ID, value: "${IMAGE_REFERENCE}"}
            - {name: MAX_CONCURRENCY, value: "1"}
            - {name: RETENTION_MS, value: "3600000"}
            - {name: ALLOWED_ORIGINS, value: "https://onco.cc"}
            - {name: CHROMIUM_SANDBOX, value: "false"}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ALL]
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
              ephemeral-storage: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
              ephemeral-storage: 1Gi
          volumeMounts:
            - {name: data, mountPath: /data}
            - {name: tmp, mountPath: /tmp}
            - {name: shm, mountPath: /dev/shm}
          startupProbe:
            exec:
              command: [node, -e, "fetch('http://127.0.0.1:8080/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
            periodSeconds: 5
            failureThreshold: 20
            timeoutSeconds: 3
          readinessProbe:
            exec:
              command: [node, -e, "fetch('http://127.0.0.1:8080/v1/preflight',{headers:{'X-Rapp-Protocol':'1'}}).then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
            periodSeconds: 15
            timeoutSeconds: 3
          livenessProbe:
            exec:
              command: [node, -e, "fetch('http://127.0.0.1:8080/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
            periodSeconds: 30
            timeoutSeconds: 3
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: playwright-artifacts
        - name: tmp
          emptyDir:
            sizeLimit: 512Mi
        - name: shm
          emptyDir:
            medium: Memory
            sizeLimit: 256Mi
---
apiVersion: v1
kind: Service
metadata:
  name: playwright
  namespace: playwright
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: playwright
  ports:
    - {name: http, port: 8080, targetPort: http}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: playwright
  namespace: playwright
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: playwright
  policyTypes: [Ingress, Egress]
  ingress: []
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - {protocol: UDP, port: 53}
        - {protocol: TCP, port: 53}
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except: [0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4]
      ports:
        - {protocol: TCP, port: 443}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: playwright-consumer
  namespace: playwright
rules:
  - apiGroups: [""]
    resources: [pods]
    verbs: [get, list]
  - apiGroups: [""]
    resources: [pods/portforward]
    verbs: [create]
  - apiGroups: [apps]
    resources: [deployments]
    resourceNames: [playwright]
    verbs: [get]