apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ taskserv.name }}
  namespace: {{ taskserv.namespace }}
  labels:
    app.kubernetes.io/name: {{ taskserv.name }}
    app.kubernetes.io/managed-by: provisioning
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ taskserv.name }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ taskserv.name }}
        app.kubernetes.io/managed-by: provisioning
    spec:
{% if taskserv.node %}
      nodeSelector:
        kubernetes.io/hostname: {{ taskserv.node }}
{% endif %}
{% if taskserv.host_network %}
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
{% endif %}
      terminationGracePeriodSeconds: 30
      initContainers:
        - name: sysctl-init
          image: busybox:1.36
          securityContext:
            privileged: true
          command:
            - sh
            - -c
            - |
              sysctl -w net.ipv4.ip_forward=1
              sysctl -w net.ipv4.conf.all.src_valid_mark=1
      containers:
        - name: {{ taskserv.name }}
          image: {{ taskserv.image }}
          ports:
            - containerPort: {{ taskserv.listen_port }}
              name: wireguard
              protocol: UDP
            - containerPort: {{ taskserv.ui_port }}
              name: ui
              protocol: TCP
          envFrom:
            - configMapRef:
                name: {{ taskserv.name }}-env
            - secretRef:
                name: wireguard-keys
            - secretRef:
                name: wireguard-credentials
          securityContext:
            privileged: true
          readinessProbe:
            tcpSocket:
              port: {{ taskserv.ui_port }}
            initialDelaySeconds: 15
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 3
          livenessProbe:
            tcpSocket:
              port: {{ taskserv.ui_port }}
            initialDelaySeconds: 30
            periodSeconds: 20
            timeoutSeconds: 3
            failureThreshold: 3
          resources:
            requests:
              cpu: "50m"
              memory: "64Mi"
            limits:
              cpu: "500m"
              memory: "256Mi"
          volumeMounts:
            - name: data
              mountPath: /etc/wireguard
            - name: kernel-modules
              mountPath: /lib/modules
              readOnly: true
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: wireguard-data
        - name: kernel-modules
          hostPath:
            path: /lib/modules
            type: Directory