apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-ingress
  namespace: nginx-ingress
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx-ingress
  template:
    metadata:
      labels:
        app: nginx-ingress
        nsm.nginx.com/deployment: nginx-ingress
        spiffe.io/spiffeid: "true"
      annotations:
        nsm.nginx.com/enable-ingress: "true"
        #nsm.nginx.com/enable-egress: "true"
        prometheus.io/scrape: "true"
        prometheus.io/port: "9113"
    spec:
      serviceAccountName: nginx-ingress
      containers:
      - image: nginx-plus-ingress:version
        imagePullPolicy: Always
        name: nginx-plus-ingress
        ports:
        - name: http
          containerPort: 80
        - name: https
          containerPort: 443
        - name: prometheus
          containerPort: 9113
        - name: readiness-port
          containerPort: 8081
        readinessProbe:
          httpGet:
            path: /nginx-ready
            port: readiness-port
          periodSeconds: 1
        securityContext:
          allowPrivilegeEscalation: true
          runAsUser: 101 #nginx
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE
        volumeMounts:
        - mountPath: /run/spire/sockets
          name: spire-agent-socket
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_SERVICEACCOUNT
          valueFrom:
            fieldRef:
              fieldPath: spec.serviceAccountName
        args:
          - -nginx-plus
          - -nginx-configmaps=$(POD_NAMESPACE)/nginx-config
          - -default-server-tls-secret=$(POD_NAMESPACE)/default-server-secret
          - -spire-agent-address=/run/spire/sockets/agent.sock
          - -enable-prometheus-metrics
          - -enable-latency-metrics
          #- -enable-internal-routes
          # Needed for UDP
          # - -enable-preview-policies
          # - -global-configuration=nginx-ingress/nginx-configuration
      volumes:
      - csi:
          driver: wlapi-mounter.spire.nginx.com
          readOnly: true
        name: spire-agent-socket
