apiVersion: apps/v1
kind: Deployment
metadata:
  name: push-controller
  namespace: git-system
  labels:
    app.kubernetes.io/name: git-k8s
    app.kubernetes.io/component: push-controller
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: push-controller
  template:
    metadata:
      labels:
        app.kubernetes.io/name: git-k8s
        app.kubernetes.io/component: push-controller
    spec:
      serviceAccountName: git-k8s-controller
      containers:
        - name: controller
          # ko will replace this with the actual registry image SHA.
          image: ko://github.com/imjasonh/git-k8s/cmd/push-controller
          env:
            - name: SYSTEM_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: CONFIG_LOGGING_NAME
              value: config-logging
            - name: CONFIG_OBSERVABILITY_NAME
              value: config-observability
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            capabilities:
              drop:
                - ALL