apiVersion: apps/v1
kind: Deployment
metadata:
  name: templater-service
  labels:
    app: templater-service
spec:
  replicas: 1
  selector:
    matchLabels:
      app: templater-service
  template:
    metadata:
      labels:
        app: templater-service
    spec:
      securityContext:
        fsGroup: 65533 # to make the git-sync SSH key readable
      volumes:
        - name: templater-templates-ssh
          secret:
            secretName: templater-templates-ssh
            defaultMode: 0400
        - name: templater-templates
          emptyDir: {}
      initContainers:
        - image: k8s.gcr.io/git-sync:v3.1.6
          name: template-repository-setup
          args:
            - "-repo=git@github.com:betterdoc-org/templater-templates.git"
            - "-branch=master"
            - "-depth=1"
            - "-max-sync-failures=6"
            - "-wait=10" # max-sync-failures=6 * wait=10 = 60 seconds maximum runtime for the init container
            - "-one-time=true" # exit after the first sync (we just want to initialize the file system)
            - "-root=/templates"
            - "-dest=from-github"
            - "-ssh=true"
          volumeMounts:
            - name: templater-templates-ssh
              mountPath: /etc/git-secret
              readOnly: true
            - name: templater-templates
              mountPath: "/templates"
              readOnly: false
          securityContext:
            runAsUser: 65533 # git-sync-user
      containers:
        - image: betterdoc/templater-service
          name: service
          ports:
            - containerPort: 80
              protocol: TCP
          volumeMounts:
            - name: templater-templates
              mountPath: "/templates"
              readOnly: false
          env:
            - name: TEMPLATE_ROOT
              value: "/templates/from-github/"
        - image: k8s.gcr.io/git-sync:v3.1.6
          name: git-sync-sidecar
          args:
            - "-repo=git@github.com:betterdoc-org/templater-templates.git"
            - "-branch=master"
            - "-depth=1"
            - "-max-sync-failures=-1"
            - "-root=/templates"
            - "-dest=from-github"
            - "-wait=60"
            - "-ssh=true"
          volumeMounts:
            - name: templater-templates-ssh
              mountPath: /etc/git-secret
              readOnly: true
            - name: templater-templates
              mountPath: "/templates"
              readOnly: false
          securityContext:
            runAsUser: 65533 # git-sync-user
