# Copyright 2018 Google Inc. All Rights Reserved.
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: auth-server
  annotations:
    imagetag: $IMAGETAG
    buildtag: "$TAG"
  name: auth-server
spec:
  replicas: 2
  selector:
    matchLabels:
      app: auth-server
  strategy:
    rollingUpdate:
      maxSurge: 2
      maxUnavailable: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: auth-server
    spec:
      containers:
      - command:
        - /opt/goma/bin/auth_server
        - --project-id=$PROJECT_ID
        - --auth-db-addr=https://cxx-compiler-service.appspot.com/authdb/checkMembership
        - --acl-file=/etc/goma/acl/acl
        - --service-account-json-dir=/etc/goma/service-accounts
        - --remoteexec-addr=remotebuildexecution.googleapis.com:443
        - --remote-instance-name=$RBE_INSTANCE_PREFIX/default_instance
        name: auth-server
        image: gcr.io/$CONTAINER_PROJECT_ID/auth-server:$IMAGETAG
        ports:
        - containerPort: 5050
          protocol: TCP
        - containerPort: 8081
          protocol: TCP
        resources:
          limits:
            cpu: 50m
            memory: 64Mi
          requests:
            cpu: 25m
            memory: 32Mi
        volumeMounts:
        - mountPath: /etc/goma/acl
          name: acl
        # following could be configured by PodPreset?
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 5
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8081
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 5
      volumes:
      - name: acl
        configMap:
          defaultMode: 420
          name: acl