apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: awp-subrouter-state
  namespace: awp-system
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: awp-subrouter
  namespace: awp-system
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: awp-subrouter
  template:
    metadata:
      labels:
        app.kubernetes.io/name: awp-subrouter
        app.kubernetes.io/part-of: awp
    spec:
      nodeSelector:
        kubernetes.io/hostname: debian3
      automountServiceAccountToken: false
      imagePullSecrets:
        - name: awp-ghcr-pull
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: subrouter
          image: __AWP_SUBROUTER_IMAGE__
          imagePullPolicy: IfNotPresent
          args: [serve, --addr, 0.0.0.0:31415, --sessions, /var/lib/subrouter/sessions.json]
          env:
            - name: HOME
              value: /var/lib/subrouter
            - name: SUBROUTER_STATE_DIR
              value: /var/lib/subrouter
            - name: SUBROUTER_PROXY_TOKEN_FILE
              value: /run/secrets/proxy_token
            - name: SUBROUTER_ADMIN_TOKEN_FILE
              value: /run/secrets/admin_token
            - name: SUBROUTER_ACCOUNT_IMPORT_TOKEN_FILE
              value: /run/secrets/account_import_token
            - name: GOMEMLIMIT
              value: 192MiB
            - name: GOMAXPROCS
              value: "2"
          ports:
            - name: http
              containerPort: 31415
          readinessProbe:
            exec:
              command: [/usr/local/bin/subrouter, probe, --url, http://127.0.0.1:31415]
            initialDelaySeconds: 2
            periodSeconds: 5
            timeoutSeconds: 3
          livenessProbe:
            exec:
              command: [/usr/local/bin/subrouter, probe, --url, http://127.0.0.1:31415]
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 100m
              memory: 96Mi
            limits:
              cpu: "2"
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ALL]
          volumeMounts:
            - name: state
              mountPath: /var/lib/subrouter
            - name: secrets
              mountPath: /run/secrets
              readOnly: true
      volumes:
        - name: state
          persistentVolumeClaim:
            claimName: awp-subrouter-state
        - name: secrets
          secret:
            secretName: awp-subrouter-secrets
            defaultMode: 0400
            items:
              - key: proxy_token
                path: proxy_token
              - key: admin_token
                path: admin_token
              - key: account_import_token
                path: account_import_token
---
apiVersion: v1
kind: Service
metadata:
  name: awp-subrouter
  namespace: awp-system
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: awp-subrouter
  ports:
    - name: http
      port: 31415
      targetPort: http
