apiVersion: apps/v1
kind: Deployment
metadata:
  name: s3-proxy
  namespace: s3-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: s3-proxy
  template:
    metadata:
      labels:
        app: s3-proxy
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "s3-proxy"
        vault.hashicorp.com/auth-path: "auth/kubernetes"
        vault.hashicorp.com/agent-inject-secret-tls.crt: "secrets/data/s3-proxy/tls"
        vault.hashicorp.com/agent-inject-template-tls.crt: |
          {{- with secret "secrets/data/s3-proxy/tls" -}}
          {{ .Data.data.tls_crt }}
          {{- end -}}
        vault.hashicorp.com/agent-inject-secret-tls.key: "secrets/data/s3-proxy/tls"
        vault.hashicorp.com/agent-inject-template-tls.key: |
          {{- with secret "secrets/data/s3-proxy/tls" -}}
          {{ .Data.data.tls_key }}
          {{- end -}}
    spec:
      serviceAccountName: s3-proxy
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      nodeSelector:
        kubernetes.io/hostname: sarex-srv-generic-1
      containers:
        - name: nginx
          image: nginx:1.25-alpine
          volumeMounts:
            - name: nginx-conf
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
          ports:
            - name: s3-tls
              containerPort: 443
              hostPort: 443
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 500m
              memory: 256Mi
      volumes:
        - name: nginx-conf
          configMap:
            name: s3-proxy-nginx-conf