apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysqlclient
spec:
  replicas: 1
  #serviceName: mysqlclient
  selector:
    matchLabels:
      app.kubernetes.io/instance: mysqlclient
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: mysqlclient
    spec:
      terminationGracePeriodSeconds: 0
      initContainers:
      - name: init-tls
        image: ghcr.io/spiffe/spiffe-helper:0.8.0
        imagePullPolicy: IfNotPresent
        command:
        - /spiffe-helper
        - -config
        - /etc/spiffe-helper.conf
        - -daemon-mode=false
        securityContext:
          runAsUser: 1001
          runAsGroup: 1001
        volumeMounts:
        - name: spiffe-workload-api
          mountPath: /spiffe-workload-api
          readOnly: true
        - name: spiffe-helper-configmap
          mountPath: /etc/spiffe-helper.conf
          subPath: spiffe-helper.conf
          readOnly: true
        - name: certdir
          mountPath: /certs
      containers:
      - name: main
        image: docker.io/bitnami/mysql:8.0.35-debian-11-r0
        command: [sleep, inf]
        securityContext:
          runAsUser: 1001
          runAsGroup: 1001
        volumeMounts:
        - name: certdir
          mountPath: /certs
      - name: refresh-tls
        image: ghcr.io/spiffe/spiffe-helper:0.8.0
        imagePullPolicy: IfNotPresent
        command:
        - /spiffe-helper
        - -config
        - /etc/spiffe-helper.conf
        securityContext:
          runAsUser: 1001
          runAsGroup: 1001
        volumeMounts:
        - name: spiffe-workload-api
          mountPath: /spiffe-workload-api
          readOnly: true
        - name: spiffe-helper-configmap
          mountPath: /etc/spiffe-helper.conf
          subPath: spiffe-helper.conf
          readOnly: true
        - name: certdir
          mountPath: /certs
      volumes:
      - name: certdir
        emptyDir: {}
      - name: spiffe-helper-configmap
        configMap:
          name: mysqlclient
      - name: spiffe-workload-api
        csi:
          driver: "csi.spiffe.io"
          readOnly: true