apiVersion: apps/v1
kind: Deployment
metadata:
  name: awp-model-gateway
  namespace: awp-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: awp-model-gateway
  template:
    metadata:
      labels:
        app.kubernetes.io/name: awp-model-gateway
        app.kubernetes.io/part-of: awp
    spec:
      nodeSelector:
        kubernetes.io/hostname: debian3
      automountServiceAccountToken: false
      imagePullSecrets:
        - name: awp-ghcr-pull
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: gateway
          image: __AWP_MODEL_GATEWAY_IMAGE__
          imagePullPolicy: IfNotPresent
          env:
            - name: AWP_GATEWAY_HOST
              value: 0.0.0.0
            - name: AWP_GATEWAY_PORT
              value: "32180"
            - name: AWP_SUBROUTER_URL
              value: http://awp-subrouter.awp-system.svc.cluster.local:31415
            - name: AWP_SUBROUTER_PROXY_TOKEN_FILE
              value: /run/secrets/subrouter_proxy_token
            - name: AWP_MODEL_GATEWAY_SIGNING_SECRET_FILE
              value: /run/secrets/signing_secret
          ports:
            - name: http
              containerPort: 32180
          readinessProbe:
            tcpSocket:
              port: http
            initialDelaySeconds: 2
            periodSeconds: 5
          livenessProbe:
            tcpSocket:
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            requests:
              cpu: 50m
              memory: 48Mi
            limits:
              cpu: 500m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ALL]
          volumeMounts:
            - name: secrets
              mountPath: /run/secrets
              readOnly: true
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: secrets
          secret:
            secretName: awp-model-gateway-secrets
            defaultMode: 0440
        - name: tmp
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: awp-model-gateway
  namespace: awp-system
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: awp-model-gateway
  ports:
    - name: http
      port: 32180
      targetPort: http
