---
# Pangolin Kube Controller Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: pangolin-kube-controller
  namespace: pangolin
  labels:
    app.kubernetes.io/name: pangolin-kube-controller
    app.kubernetes.io/component: controller
    app.kubernetes.io/part-of: pangolin
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: pangolin-kube-controller
  template:
    metadata:
      labels:
        app.kubernetes.io/name: pangolin-kube-controller
        app.kubernetes.io/component: controller
        app.kubernetes.io/part-of: pangolin
    spec:
      serviceAccountName: pangolin-kube-controller
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: controller
        image: ghcr.io/fosrl/pangolin-kube-controller:0.1.0-alpha.1
        imagePullPolicy: IfNotPresent
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 65532
          capabilities:
            drop:
              - ALL
        env:
          # Pangolin API Configuration
          - name: CONFIG_ENDPOINT
            value: "https://pangolin.basicstack.de/api/v1/traefik-config"
          - name: CONFIG_AUTH_HEADER
            value: "Bearer 5qid06u9j325kpk.ywd3bpsx34dtxyczgatyxuoxkzwhie7d72k6v4hw"

          # Target namespace for Traefik resources
          - name: TARGET_NAMESPACE
            value: "pangolin"

          # Metrics server configuration
          - name: METRICS_ADDR
            value: ":9090"

          # Polling interval
          - name: POLL_INTERVAL
            value: "15s"

          # Leader election (disabled for single replica)
          - name: ENABLE_LEADER_ELECTION
            value: "false"

          # Traefik ingress class
          - name: INGRESS_CLASS
            value: "traefik"

          # Logging configuration
          - name: LOG_TRAEFIK_CONFIG
            value: "false"
          - name: CONFIG_LOG_PREVIEW
            value: "false"
          - name: FETCH_LOG_INTERVAL
            value: "5m"
        ports:
        - name: metrics
          containerPort: 9090
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /livez
            port: 9090
          initialDelaySeconds: 15
          periodSeconds: 20
          timeoutSeconds: 5
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /readyz
            port: 9090
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "256Mi"
            cpu: "200m"