deployment.yml

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    {{- include "common.resource-labels" . | indent 4 }}
  name: {{ $.Release.Name }}
  namespace: {{ $.Release.Namespace }}
spec:
  replicas: {{ .Values.replicas | default 1 }}
  selector:
    matchLabels:
      app.kubernetes.io/name: pomerium
      app.kubernetes.io/instance: {{ .Release.Name }}
  template:
    metadata:
      labels:
        homecentr.one/antiaffinity: pomerium
        {{- include "common.resource-labels" . | indent 8 }}
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        fsGroup: 1000
        fsGroupChangePolicy: Always
        seccompProfile:
          type: RuntimeDefault
        seLinuxOptions:
          user: system_u
          role: system_r
          type: container_t
          level: s0:c829,c861
      automountServiceAccountToken: true
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              topologyKey: kubernetes.io/hostname
              labelSelector:
                matchExpressions:
                - key: homecentr.one/antiaffinity
                  operator: In
                  values:
                  - pomerium
      containers:
      - args:
        - all-in-one
        - --pomerium-config=global
        - --update-status-from-service=$(POMERIUM_NAMESPACE)/pomerium-proxy
        - --metrics-bind-address=$(POD_IP):9090
        env:
        - name: TMPDIR
          value: /tmp
        - name: XDG_CACHE_HOME
          value: /tmp
        - name: POMERIUM_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        image: pomerium/ingress-controller:{{ .Values.imageTag }}
        imagePullPolicy: IfNotPresent
        name: pomerium
        readinessProbe:
          httpGet:
            scheme: HTTPS
            path: /healthz
            port: 8443
          initialDelaySeconds: 15
          periodSeconds: 5
        ports:
        - containerPort: 8443
          name: https
          protocol: TCP
        - containerPort: 8080
          name: http
          protocol: TCP
        - containerPort: 9090
          name: metrics
          protocol: TCP
        resources: {{ .Values.resources | toYaml | nindent 10 }}
        securityContext:
            runAsUser: 1000
            runAsGroup: 1000
            runAsNonRoot: true
            readOnlyRootFilesystem : true
            procMount: Default
            privileged: false
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            seccompProfile:
              type: RuntimeDefault
            seLinuxOptions:
              user: system_u
              role: system_r
              type: container_t
              level: s0:c829,c861
        volumeMounts:
        - mountPath: /tmp
          name: tmp
        - mountPath: /.local
          name: local
      nodeSelector:
        kubernetes.io/os: linux
      securityContext:
        runAsNonRoot: true
        seLinuxOptions:
          user: system_u
          role: system_r
          type: container_t
          level: s0:c829,c861
      serviceAccountName: pomerium-controller
      terminationGracePeriodSeconds: 10
      volumes:
      - emptyDir: {}
        name: tmp
      - emptyDir: {}
        name: local