apiVersion: apps/v1
kind: Deployment
metadata:
  name: the-hub
  namespace: the-hub
  labels:
    app.kubernetes.io/name: the-hub
    app.kubernetes.io/part-of: mk-labs
spec:
  replicas: 1
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: the-hub
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: the-hub
      annotations:
        # Force pod restart when the glance config ConfigMap changes
        # (Kubernetes does not automatically restart pods on ConfigMap updates)
        checksum/config: "{{ include (print $.Template.BasePath \"/configmap.yaml\") . | sha256sum }}"
    spec:
      serviceAccountName: the-hub
      automountServiceAccountToken: true
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: glance
          image: glanceapp/glance:latest
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          env:
            # Injected from ExternalSecret — API tokens used in glance.yml
            # via ${ENV_VAR} syntax
            - name: PROXMOX_TOKEN
              valueFrom:
                secretKeyRef:
                  name: the-hub-secrets
                  key: PROXMOX_TOKEN
            - name: PBS_TOKEN
              valueFrom:
                secretKeyRef:
                  name: the-hub-secrets
                  key: PBS_TOKEN
            - name: GRAFANA_TOKEN
              valueFrom:
                secretKeyRef:
                  name: the-hub-secrets
                  key: GRAFANA_TOKEN
            - name: GITEA_TOKEN
              valueFrom:
                secretKeyRef:
                  name: the-hub-secrets
                  key: GITEA_TOKEN
          volumeMounts:
            - name: config
              mountPath: /app/config/glance.yml
              subPath: glance.yml
              readOnly: true
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 128Mi
          livenessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 15
            periodSeconds: 30
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
      volumes:
        - name: config
          configMap:
            name: the-hub-config