apiVersion: apps/v1
kind: Deployment
metadata:
  name: backstage
  namespace: backstage
  labels:
    app.kubernetes.io/name: backstage
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: backstage
  template:
    metadata:
      labels:
        app.kubernetes.io/name: backstage
    spec:
      serviceAccountName: backstage
      securityContext:
        fsGroup: 1000
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: backstage
          image: zot.ad.ddupan.top/panxiao81/backstage@sha256:493aed471c58b21db7a108a333417498fc03682d119282b89cd0318563d6cae6
          imagePullPolicy: IfNotPresent
          env:
            - name: BACKSTAGE_BASE_URL
              value: https://backstage.ad.ddupan.top
            - name: POSTGRES_HOST
              value: shared-postgresql-rw.shared-db.svc.cluster.local
            - name: POSTGRES_PORT
              value: "5432"
            - name: POSTGRES_USER
              value: backstage
            - name: POSTGRES_DATABASE
              value: backstage
            - name: GITEA_HOST
              value: git.ddupan.top
          envFrom:
            - secretRef:
                name: backstage
          ports:
            - containerPort: 7007
              name: http
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /.backstage/health/v1/readiness
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 3
          livenessProbe:
            httpGet:
              path: /.backstage/health/v1/liveness
              port: http
            initialDelaySeconds: 30
            periodSeconds: 20
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 100m
              memory: 512Mi
            limits:
              cpu: "1"
              memory: 1Gi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
          volumeMounts:
            - mountPath: /tmp
              name: tmp
      volumes:
        - emptyDir: {}
          name: tmp