apiVersion: apps/v1
kind: Deployment
metadata: {name: iam, namespace: enkly, labels: {app: iam}}
spec:
  replicas: 1
  selector: {matchLabels: {app: iam}}
  template:
    metadata: {labels: {app: iam}}
    spec:
      imagePullSecrets: [{name: enkly-registry}]
      # Nothing in Kubernetes enforces start order between Deployments, and
      # rabbitmq's own readiness probe can take a while to go green (see
      # 10-rabbitmq.yaml). Without this, iam races the broker on a fresh
      # rollout and can hit the same "connection refused" notification saw.
      initContainers:
        - name: wait-for-rabbitmq
          image: busybox:1.36
          command: ["sh", "-c", "until nc -z rabbitmq 5672; do echo waiting for rabbitmq; sleep 2; done"]
      containers:
        - name: iam
          image: registry.enkly.org/enkly/iam:latest
          ports: [{name: grpc, containerPort: 9001}]
          envFrom: [{configMapRef: {name: enkly-config}}]
          env:
            - name: POSTGRES_PASSWORD
              valueFrom: {secretKeyRef: {name: enkly-secrets, key: POSTGRES_PASSWORD}}
            - {name: ENKLY_IAM_POSTGRES_DSN, value: "postgres://enkly:$(POSTGRES_PASSWORD)@iam-db:5432/enkly_iam?sslmode=disable"}
            - name: ENKLY_RABBITMQ_URL
              valueFrom: {secretKeyRef: {name: enkly-secrets, key: ENKLY_RABBITMQ_URL}}
            - name: ENKLY_SMTP_USERNAME
              valueFrom: {secretKeyRef: {name: enkly-secrets, key: ENKLY_SMTP_USERNAME}}
            - name: ENKLY_SMTP_PASSWORD
              valueFrom: {secretKeyRef: {name: enkly-secrets, key: ENKLY_SMTP_PASSWORD}}
          resources:
            requests: {cpu: 50m, memory: 64Mi}
            limits: {cpu: 500m, memory: 256Mi}
          readinessProbe: {grpc: {port: 9001}, initialDelaySeconds: 5, periodSeconds: 10, failureThreshold: 10}
          livenessProbe: {grpc: {port: 9001}, initialDelaySeconds: 15, periodSeconds: 20, failureThreshold: 6}
---
apiVersion: v1
kind: Service
metadata: {name: iam, namespace: enkly, labels: {app: iam}}
spec:
  selector: {app: iam}
  ports: [{name: grpc, port: 9001, targetPort: grpc}]