# The gateway: control+data plane that turns the resources into a usable
# service. Build the image first (see README step 8):
#   docker build -t dsh-aaas-gateway:demo gateway/
#   kind load docker-image dsh-aaas-gateway:demo   # (kind clusters)
apiVersion: v1
kind: ServiceAccount
metadata:
  name: dsh-gateway
  namespace: dsh-demo
---
# Least privilege: claims are created/deleted per user; sandboxes are only
# read and patched (operatingMode flips for suspend/resume).
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: dsh-gateway
  namespace: dsh-demo
rules:
  - apiGroups: ["extensions.agents.x-k8s.io"]
    resources: ["sandboxclaims"]
    verbs: ["get", "list", "create", "delete"]
  - apiGroups: ["agents.x-k8s.io"]
    resources: ["sandboxes"]
    verbs: ["get", "list", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: dsh-gateway
  namespace: dsh-demo
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: dsh-gateway
subjects:
  - kind: ServiceAccount
    name: dsh-gateway
    namespace: dsh-demo
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dsh-gateway
  namespace: dsh-demo
spec:
  replicas: 1 # in-memory idle clock => single replica by design
  selector:
    matchLabels:
      app: dsh-gateway
  template:
    metadata:
      labels:
        app: dsh-gateway
    spec:
      serviceAccountName: dsh-gateway
      securityContext:
        runAsNonRoot: true
        runAsUser: 10000 # matches USER in gateway/Dockerfile
        runAsGroup: 10000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: gateway
          image: dsh-aaas-gateway:demo
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          ports:
            - containerPort: 8080
          env:
            - name: NAMESPACE
              value: dsh-demo
            - name: POOL
              value: dsh-pool
            - name: IDLE_TIMEOUT
              value: "60"
          resources:
            requests: {cpu: 50m, memory: 128Mi}
            limits: {cpu: 500m, memory: 256Mi}
---
apiVersion: v1
kind: Service
metadata:
  name: dsh-gateway
  namespace: dsh-demo
spec:
  selector:
    app: dsh-gateway
  ports:
    - port: 8080
      targetPort: 8080