{
  "apiVersion": "v1",
  "kind": "List",
  "items": [
    {
      "apiVersion": "v1",
      "kind": "PersistentVolumeClaim",
      "metadata": {
        "name": "state-hub-memo-dispatch",
        "namespace": "state-hub",
        "annotations": {
          "state-hub.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
        }
      },
      "spec": {
        "accessModes": [
          "ReadWriteOnce"
        ],
        "storageClassName": "local-path",
        "resources": {
          "requests": {
            "storage": "1Gi"
          }
        }
      }
    },
    {
      "apiVersion": "apps/v1",
      "kind": "Deployment",
      "metadata": {
        "name": "state-hub-memo-dispatch",
        "namespace": "state-hub",
        "annotations": {
          "state-hub.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
        }
      },
      "spec": {
        "replicas": 1,
        "strategy": {
          "type": "Recreate"
        },
        "selector": {
          "matchLabels": {
            "app.kubernetes.io/name": "state-hub",
            "app.kubernetes.io/component": "memo-dispatch"
          }
        },
        "template": {
          "metadata": {
            "labels": {
              "app.kubernetes.io/name": "state-hub",
              "app.kubernetes.io/component": "memo-dispatch"
            }
          },
          "spec": {
            "serviceAccountName": "state-hub",
            "automountServiceAccountToken": false,
            "terminationGracePeriodSeconds": 15,
            "securityContext": {
              "runAsNonRoot": true,
              "runAsUser": 10001,
              "runAsGroup": 10001,
              "fsGroup": 10001,
              "fsGroupChangePolicy": "OnRootMismatch",
              "seccompProfile": {
                "type": "RuntimeDefault"
              }
            },
            "containers": [
              {
                "name": "dispatcher",
                "image": "forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f",
                "securityContext": {
                  "allowPrivilegeEscalation": false,
                  "readOnlyRootFilesystem": true,
                  "capabilities": {
                    "drop": [
                      "ALL"
                    ]
                  }
                },
                "resources": {
                  "requests": {
                    "cpu": "5m",
                    "memory": "24Mi"
                  },
                  "limits": {
                    "cpu": "100m",
                    "memory": "96Mi"
                  }
                },
                "volumeMounts": [
                  {
                    "name": "queue",
                    "mountPath": "/data"
                  },
                  {
                    "name": "intake-caller",
                    "mountPath": "/var/run/secrets/state-hub/informed-decision",
                    "readOnly": true
                  }
                ]
              }
            ],
            "volumes": [
              {
                "name": "queue",
                "persistentVolumeClaim": {
                  "claimName": "state-hub-memo-dispatch"
                }
              },
              {
                "name": "intake-caller",
                "projected": {
                  "defaultMode": 288,
                  "sources": [
                    {
                      "serviceAccountToken": {
                        "audience": "informed-decision-intake",
                        "expirationSeconds": 600,
                        "path": "intake-token"
                      }
                    },
                    {
                      "serviceAccountToken": {
                        "audience": "informed-decision-lifecycle",
                        "expirationSeconds": 600,
                        "path": "lifecycle-token"
                      }
                    }
                  ]
                }
              }
            ],
            "initContainers": [
              {
                "name": "prepare-private-queue",
                "image": "forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f",
                "command": [
                  "python",
                  "-c",
                  "import os, stat\np='/data/private'\ntry:\n    os.mkdir(p, 0o700)\nexcept FileExistsError:\n    pass\nfd=os.open(p, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)\ntry:\n    info=os.fstat(fd)\n    if info.st_uid != os.getuid():\n        raise SystemExit('queue owner refused')\n    mode=stat.S_IMODE(info.st_mode)\n    if mode == 0o2700 and not os.listdir(fd):\n        os.fchmod(fd, 0o700)\n    elif mode != 0o700:\n        raise SystemExit('queue mode refused')\nfinally:\n    os.close(fd)\n"
                ],
                "securityContext": {
                  "allowPrivilegeEscalation": false,
                  "readOnlyRootFilesystem": true,
                  "capabilities": {
                    "drop": [
                      "ALL"
                    ]
                  }
                },
                "resources": {
                  "requests": {
                    "cpu": "5m",
                    "memory": "24Mi"
                  },
                  "limits": {
                    "cpu": "100m",
                    "memory": "96Mi"
                  }
                },
                "volumeMounts": [
                  {
                    "name": "queue",
                    "mountPath": "/data"
                  }
                ]
              }
            ]
          }
        }
      }
    },
    {
      "apiVersion": "networking.k8s.io/v1",
      "kind": "NetworkPolicy",
      "metadata": {
        "name": "state-hub-memo-dispatch",
        "namespace": "state-hub",
        "annotations": {
          "state-hub.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
        }
      },
      "spec": {
        "podSelector": {
          "matchLabels": {
            "app.kubernetes.io/name": "state-hub",
            "app.kubernetes.io/component": "memo-dispatch"
          }
        },
        "policyTypes": [
          "Ingress",
          "Egress"
        ],
        "ingress": [],
        "egress": [
          {
            "to": [
              {
                "namespaceSelector": {
                  "matchLabels": {
                    "kubernetes.io/metadata.name": "kube-system"
                  }
                },
                "podSelector": {
                  "matchLabels": {
                    "k8s-app": "kube-dns"
                  }
                }
              }
            ],
            "ports": [
              {
                "protocol": "UDP",
                "port": 53
              },
              {
                "protocol": "TCP",
                "port": 53
              }
            ]
          },
          {
            "to": [
              {
                "namespaceSelector": {
                  "matchLabels": {
                    "kubernetes.io/metadata.name": "informed-decision"
                  }
                },
                "podSelector": {
                  "matchLabels": {
                    "app.kubernetes.io/name": "informed-decision"
                  }
                }
              }
            ],
            "ports": [
              {
                "protocol": "TCP",
                "port": 8081
              }
            ]
          }
        ]
      }
    }
  ]
}