deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: session-checker
spec:
  replicas: 2
  selector:
    matchLabels:
      app: session-checker
  template:
    metadata:
      labels:
        app: session-checker
        azure.workload.identity/use: "true"
    spec:
      serviceAccountName: demoapp-sa
      containers:
      - name: session-checker
        image: ghcr.io/torumakabe/session-checker:v1.3.3 # {"$imagepolicy": "flux-system:session-checker"}
        imagePullPolicy: IfNotPresent
        command: ["/session-checker"]
        volumeMounts:
        - name: secrets-store01-inline
          mountPath: "/mnt/secrets-store"
          readOnly: true
        env:
        - name: SESSION_CHECKER_REDIS_SERVER
          valueFrom:
            secretKeyRef:
              name: demoapp-secret
              key: redis-server
        - name: SESSION_CHECKER_REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: demoapp-secret
              key: redis-password
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
        securityContext:
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsUser: 10001
          runAsGroup: 10001
        resources:
          requests:
            cpu: 10m
            memory: 50Mi
          limits:
            cpu: 100m
            memory: 100Mi
      volumes:
      - name: secrets-store01-inline
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: "azure-sync"
      dnsPolicy: "Default"
      securityContext:
        seccompProfile:
          type: RuntimeDefault