apiVersion: v1
kind: Namespace
metadata:
  name: ${OWN_NAMESPACE}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: state
  namespace: ${OWN_NAMESPACE}
spec:
  storageClassName: ${STORAGE_CLASS_NAME}
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: probe
  namespace: ${OWN_NAMESPACE}
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: c37-probe
  template:
    metadata:
      labels:
        app: c37-probe
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: probe
          image: ${PROBE_IMAGE}
          ports:
            - name: http
              containerPort: 18080
          readinessProbe:
            httpGet:
              path: /ready
              port: http
            periodSeconds: 5
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
          volumeMounts:
            - name: state
              mountPath: /tmp/containers-state
      volumes:
        - name: state
          persistentVolumeClaim:
            claimName: state
---
apiVersion: v1
kind: Service
metadata:
  name: probe
  namespace: ${OWN_NAMESPACE}
spec:
  selector:
    app: c37-probe
  ports:
    - name: http
      port: 18080
      targetPort: http
---
apiVersion: v1
kind: Pod
metadata:
  name: client
  namespace: ${OWN_NAMESPACE}
spec:
  automountServiceAccountToken: false
  securityContext:
    runAsNonRoot: true
    runAsUser: 65532
    runAsGroup: 65532
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: client
      image: ${PROBE_IMAGE}
      command: [python3, -c, "import time; time.sleep(3600)"]