helm-charts/urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
spec:
  replicas: {{ include "urlaubsverwaltung.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.urlaubsverwaltung.replicas) }}
  selector:
    matchLabels:
      app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
  template:
    metadata:
      name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
      labels:
        app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
    spec:
      automountServiceAccountToken: false
      securityContext:
        {{- include "urlaubsverwaltung.podSecurityContext" .Values.urlaubsverwaltung.securityContext | nindent 8 }}
      containers:
        - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
          image: "docker.io/urlaubsverwaltung/urlaubsverwaltung:{{ .Chart.AppVersion }}"
          imagePullPolicy: IfNotPresent
          securityContext:
            {{- include "urlaubsverwaltung.containerSecurityContext" .Values.urlaubsverwaltung.securityContext | nindent 12 }}
          volumeMounts:
            # The JVM (Tomcat work dir, temp files) needs a writable /tmp with
            # a read-only root filesystem.
            - name: tmp
              mountPath: /tmp
          ports:
            - containerPort: 8080
              name: http
              protocol: TCP
          env:
            # Database
            - name: SPRING_DATASOURCE_URL
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
                  key: jdbc-url
            - name: SPRING_DATASOURCE_USERNAME
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
                  key: username
            - name: SPRING_DATASOURCE_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
                  key: password
            # Mail
            - name: UV_MAIL_FROM
              value: urlaubsverwaltung@example.org
            - name: UV_MAIL_FROMDISPLAYNAME
              value: urlaubsverwaltung
            - name: UV_MAIL_REPLYTO
              value: urlaubsverwaltung@example.org
            - name: UV_MAIL_REPLYTODISPLAYNAME
              value: urlaubsverwaltung
            - name: UV_MAIL_APPLICATIONURL
              value: http://localhost:8080
            - name: SPRING_MAIL_HOST
              value: localhost
            - name: SPRING_MAIL_PORT
              value: "1025"
            # Calendar
            - name: UV_CALENDAR_ORGANIZER
              value: organizer@example.org
            # OpenID Connect identity provider
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_CLIENT-ID
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
                  key: client-id
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_CLIENT-SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
                  key: client-secret
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_CLIENT-NAME
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
                  key: issuer-name
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_PROVIDER
              value: default
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_SCOPE
              value: openid,profile,email,roles,offline_access,uv_claims
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_AUTHORIZATION-GRANT-TYPE
              value: authorization_code
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_REDIRECT-URI
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
                  key: redirect-uri
            - name: SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_DEFAULT_ISSUER-URI
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
                  key: issuer-uri
            - name: SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER-URI
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
                  key: jwt-issuer-uri
            - name: UV_SECURITY_OIDC_CLAIM-MAPPERS_GROUP-CLAIM_ENABLED
              value: "true"
            - name: UV_SECURITY_OIDC_CLAIM-MAPPERS_GROUP-CLAIM_CLAIM-NAME
              value: "groups"
            {{- range $value := .Values.urlaubsverwaltung.env }}
            {{- if $value.value }}
            - name: {{ $value.name | quote }}
              value: {{ tpl $value.value $ | quote }}
            {{- else if $value.valueFrom }}
            {{- if $value.valueFrom.secretKeyRef }}
            - name: {{ $value.name }}
              valueFrom:
                secretKeyRef:
                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
            {{- else if $value.valueFrom.configMapKeyRef }}
            - name: {{ $value.name }}
              valueFrom:
                configMapKeyRef:
                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
            {{- end }}
            {{- end }}
            {{- end }}
          resources:
            {{- include "urlaubsverwaltung.effectiveResources" .Values.urlaubsverwaltung.resources | nindent 12 }}
          livenessProbe:
            {{- include "urlaubsverwaltung.livenessProbe" .Values.urlaubsverwaltung.livenessProbe | nindent 12 }}
          readinessProbe:
            {{- include "urlaubsverwaltung.readinessProbe" .Values.urlaubsverwaltung.readinessProbe | nindent 12 }}
          startupProbe:
            {{- include "urlaubsverwaltung.startupProbe" .Values.urlaubsverwaltung.startupProbe | nindent 12 }}
      volumes:
        - name: tmp
          emptyDir: {}
      restartPolicy: Always