---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gatekeeper-public-link
  namespace: document-link
  labels:
    app: gatekeeper-public-link
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: gatekeeper-public-link
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: gatekeeper-public-link
    spec:
      containers:
      - args:
        - --discovery-url=https://keycloak.sarex.dsinv.ru/realms/sarex/.well-known/openid-configuration
        - --listen=0.0.0.0:8080
        - --enable-logging=true
        - --upstream-url=http://frontend-service:80/
        - --enable-refresh-tokens=true
        - --enable-session-cookies=true
        - --verbose
        - --resources=uri=/*
        - --encryption-key=zfDjuszywHSbAhY8KJQbESbpUYN74XTs
        - --secure-cookie=false
        - --skip-openid-provider-tls-verify=true
        env:
        - name: PROXY_REDIRECTION_URL
          value: https://document-link.sarex.dsinv.ru
        - name: PROXY_CLIENT_ID
          valueFrom:
            secretKeyRef:
              key: client_id
              name: gatekeeper-secret
        - name: PROXY_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              key: client_secret
              name: gatekeeper-secret
        image: cr.yandex/crp3ccidau046kdj8g9q/gatekeeper:1.4.2
        imagePullPolicy: IfNotPresent
        name: gatekeeper
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      imagePullSecrets:
      - name: dockerhub
      nodeSelector:
        name: generic
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
---
apiVersion: v1
kind: Service
metadata:
  name: gatekeeper-service-link
  namespace: document-link
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    app: gatekeeper-public-link
  sessionAffinity: None
  type: ClusterIP