apiVersion: v1
kind: Namespace
metadata:
  name: c36-own
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: state
  namespace: c36-own
spec:
  storageClassName: ${STORAGE_CLASS_NAME}
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: probe
  namespace: c36-own
spec:
  replicas: 1
  revisionHistoryLimit: 2
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: c36-probe
  template:
    metadata:
      labels:
        app: c36-probe
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: probe
          image: ${PROBE_IMAGE}
          ports:
            - name: http
              containerPort: 18080
          readinessProbe:
            httpGet:
              path: /ready
              port: http
            periodSeconds: 5
            timeoutSeconds: 2
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
          volumeMounts:
            - name: state
              mountPath: /tmp/containers-state
      volumes:
        - name: state
          persistentVolumeClaim:
            claimName: state
---
apiVersion: v1
kind: Service
metadata:
  name: probe
  namespace: c36-own
spec:
  selector:
    app: c36-probe
  ports:
    - name: http
      port: 18080
      targetPort: http
---
apiVersion: v1
kind: Pod
metadata:
  name: client
  namespace: c36-own
  labels:
    app: c36-client
spec:
  automountServiceAccountToken: false
  securityContext:
    runAsNonRoot: true
    runAsUser: 65532
    runAsGroup: 65532
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: client
      image: ${PROBE_IMAGE}
      command: [python3, -c, "import time; time.sleep(86400)"]
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: [ALL]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: probe-from-client
  namespace: c36-own
spec:
  podSelector:
    matchLabels:
      app: c36-probe
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: c36-client
      ports:
        - protocol: TCP
          port: 18080