# The controller. Its own machine key is the single bootstrap credential: it is
# created once and mounted here, and this process creates every other credential.
#
# The image must be built and pushed before this Deployment can start. Until then
# the object stays Pending, which is why no Argo CD Application is wired yet.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: key-rotation-controller
  namespace: iam
  labels:
    app: key-rotation-controller
spec:
  replicas: 1
  selector:
    matchLabels:
      app: key-rotation-controller
  template:
    metadata:
      labels:
        app: key-rotation-controller
    spec:
      serviceAccountName: key-rotation-controller
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: controller
          image: forgejo.riotpiao.com/riotpiao-poimen/key-rotation-controller:0.1.0
          imagePullPolicy: IfNotPresent
          args:
            - --scan-interval=10m
          env:
            - {name: ZITADEL_ISSUER, value: "https://zitadel.riotpiao.com"}
            - name: ZITADEL_CLIENT_ID
              valueFrom: {secretKeyRef: {name: key-rotation-controller, key: client-id}}
            - name: ZITADEL_USER_ID
              valueFrom: {secretKeyRef: {name: key-rotation-controller, key: user-id}}
            - name: ZITADEL_KEY_ID
              valueFrom: {secretKeyRef: {name: key-rotation-controller, key: key-id}}
            - {name: ZITADEL_KEY_FILE, value: "/var/run/keys/controller/key"}
          ports:
            - {name: metrics, containerPort: 8080}
            - {name: health, containerPort: 8081}
          readinessProbe:
            httpGet: {path: /healthz, port: health}
            initialDelaySeconds: 5
          livenessProbe:
            httpGet: {path: /healthz, port: health}
            initialDelaySeconds: 15
          volumeMounts:
            - {name: controller-key, mountPath: /var/run/keys/controller, readOnly: true}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: {drop: ["ALL"]}
          resources:
            requests: {cpu: 20m, memory: 64Mi}
            limits: {cpu: 500m, memory: 256Mi}
      volumes:
        - name: controller-key
          secret:
            secretName: key-rotation-controller
            items:
              - {key: key, path: key}