apiVersion: apps/v1
kind: Deployment
metadata:
  name: trillian-log-signer
  namespace: agent-trust
  labels:
    app.kubernetes.io/name: trillian-log-signer
    app.kubernetes.io/part-of: proofedmesh
spec:
  # Trillian log signer MUST run as a single replica unless master-election
  # is configured (etcd). We take the single-replica path for now.
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: trillian-log-signer
  template:
    metadata:
      labels:
        app.kubernetes.io/name: trillian-log-signer
    spec:
      containers:
        - name: log-signer
          image: gcr.io/trillian-opensource-ci/log_signer:v1.6.1
          args:
            - --storage_system=mysql
            - --mysql_uri=$(MYSQL_URI)
            - --rpc_endpoint=0.0.0.0:8090
            - --http_endpoint=0.0.0.0:8091
            - --force_master=true
            - --sequencer_interval=200ms
            - --batch_size=1000
            - --num_sequencers=10
            - --alsologtostderr
          envFrom:
            - secretRef:
                name: trillian-mysql
          ports:
            - containerPort: 8091
              name: metrics
          readinessProbe:
            httpGet:
              path: /metrics
              port: 8091
            initialDelaySeconds: 15
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /metrics
              port: 8091
            initialDelaySeconds: 60
            periodSeconds: 20
          resources:
            requests:
              cpu: "50m"
              memory: "128Mi"
            limits:
              memory: "512Mi"