apiVersion: apps/v1
kind: Deployment
metadata:
  name: maintenance
  namespace: cosmic-clash
  labels:
    app.kubernetes.io/name: maintenance
    app.kubernetes.io/component: maintenance
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: maintenance
  template:
    metadata:
      labels:
        app.kubernetes.io/name: maintenance
        app.kubernetes.io/component: maintenance
    spec:
      terminationGracePeriodSeconds: 10
      serviceAccountName: maintenance
      automountServiceAccountToken: false
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: maintenance
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                topologyKey: kubernetes.io/hostname
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: maintenance
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: maintenance
          image: ghcr.io/cosmic-clash/maintenance@sha256:0000000000000000000000000000000000000000000000000000000000000000
          args:
            - --dsn=$(COSMIC_CLASH_POSTGRES_DSN)
            - --interval=1m
            - --initial-connect-interval=1s
            - --batch=100
            - --stalled-allocation-batch=100
            - --initial-connect-batch=100
            - --live-abandonment-batch=100
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ALL]
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 256Mi
          env:
            - name: COSMIC_CLASH_POSTGRES_DSN
              valueFrom:
                secretKeyRef:
                  name: cosmic-clash-database
                  key: dsn