apiVersion: apps/v1
kind: Deployment
metadata:
  name: mattermost
  namespace: mattermost
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      component: web
  template:
    metadata:
      labels:
        component: web
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 2000
        runAsGroup: 2000
        fsGroup: 2000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: mattermost
          image: mattermost/mattermost-team-edition:10.8.1
          ports:
            - name: http
              containerPort: 8065
              protocol: TCP
          env:
            - name: MM_SERVICESETTINGS_SITEURL
              value: https://{{ .domain }}
            - name: MM_SQLSETTINGS_DRIVERNAME
              value: postgres
            - name: MM_SQLSETTINGS_DATASOURCE
              valueFrom:
                secretKeyRef:
                  name: mattermost-secrets
                  key: dbUrl
            - name: MM_FILESETTINGS_DIRECTORY
              value: /mattermost/data/
            - name: MM_PLUGINSETTINGS_PLUGINDIRECTORY
              value: /mattermost/plugins
            - name: MM_CLIENTPLUGINSSETTINGS_PLUGINDIRECTORY
              value: /mattermost/client/plugins
            - name: MM_LOGSETTINGS_CONSOLELEVEL
              value: INFO
          resources:
            limits:
              cpu: 500m
              ephemeral-storage: 1Gi
              memory: 1Gi
            requests:
              cpu: 50m
              ephemeral-storage: 50Mi
              memory: 256Mi
          volumeMounts:
            - name: mattermost-data
              mountPath: /mattermost/data
            - name: mattermost-plugins
              mountPath: /mattermost/plugins
          livenessProbe:
            httpGet:
              path: /api/v4/system/ping
              port: 8065
            initialDelaySeconds: 60
            timeoutSeconds: 5
            periodSeconds: 15
            failureThreshold: 6
          readinessProbe:
            httpGet:
              path: /api/v4/system/ping
              port: 8065
            initialDelaySeconds: 30
            timeoutSeconds: 3
            periodSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: false
      volumes:
        - name: mattermost-data
          persistentVolumeClaim:
            claimName: mattermost-data
        - name: mattermost-plugins
          persistentVolumeClaim:
            claimName: mattermost-plugins
      restartPolicy: Always