apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
spec:
  replicas: {{ include "patchmon.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.patchmon.frontend.replicas) }}
  selector:
    matchLabels:
      app: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
  template:
    metadata:
      name: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
      labels:
        app: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
    spec:
      automountServiceAccountToken: false
      securityContext:
        {{- toYaml .Values.patchmon.frontend.securityContext.pod | nindent 8 }}
      containers:
        - name: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
          image: "ghcr.io/patchmon/patchmon-frontend:{{ .Chart.AppVersion }}"
          imagePullPolicy: IfNotPresent
          securityContext:
            {{- toYaml .Values.patchmon.frontend.securityContext.container | nindent 12 }}
          ports:
            - containerPort: 3000
              protocol: TCP
              name: http
          env:
            - name: BACKEND_URL
              value: "{{ .Release.Name }}-{{ .Chart.Name }}-backend-service"
            - name: BACKEND_PORT
              value: "80"
          resources:
            {{- include "patchmon.resources" .Values.patchmon.frontend.resources | nindent 12 }}
          livenessProbe:
            httpGet:
              path: /
              port: 3000
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /
              port: 3000
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
          startupProbe:
            httpGet:
              path: /
              port: 3000
            periodSeconds: 5
            timeoutSeconds: 5
            failureThreshold: 30
          volumeMounts:
            - name: patchmon-volume
              mountPath: /usr/share/nginx/html/assets
              subPath: patchmon-assets
            # nginx-unprivileged keeps its pid file and temp dirs in /tmp, and
            # its entrypoint renders config templates into /etc/nginx/conf.d;
            # both must be writable with a read-only root filesystem.
            - name: tmp
              mountPath: /tmp
            - name: nginx-conf-d
              mountPath: /etc/nginx/conf.d
      restartPolicy: Always
      volumes:
        - name: tmp
          emptyDir: {}
        - name: nginx-conf-d
          emptyDir: {}
        - name: patchmon-volume
          persistentVolumeClaim:
            claimName: {{ .Release.Name }}-{{ .Chart.Name }}-pvc