apiVersion: apps/v1
kind: Deployment
metadata:
  name: s3-proxy
  namespace: postgresql
  labels:
    app: s3-proxy
    service: s3proxy
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: s3-proxy
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
  template:
    metadata:
      labels:
        app: s3-proxy
        service: s3proxy
      annotations:
        traffic.sidecar.istio.io/excludeOutboundPorts: "4317,4318,9411"
        proxy.istio.io/config: |
          tracing:
            sampling: 100
            zipkin:
              address: signoz-otel-collector-external.signoz.svc.cluster.local:9411
            custom_tags:
              k8s.pod.name:
                environment:
                  name: POD_NAME
              k8s.namespace.name:
                environment:
                  name: POD_NAMESPACE
              k8s.pod.ip:
                environment:
                  name: INSTANCE_IP
        vault.hashicorp.com/agent-init-first: "true"
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/auth-path: "auth/kubernetes"
        vault.hashicorp.com/role: "postgresql"
        vault.hashicorp.com/agent-inject-secret-aws-credentials: "secrets/data/postgresql/s3"
        vault.hashicorp.com/agent-inject-template-aws-credentials: |
          {{- with secret "secrets/data/postgresql/s3" -}}
          [default]
          aws_access_key_id={{ .Data.data.access_key }}
          aws_secret_access_key={{ .Data.data.secret_key }}
          {{- end }}
    spec:
      serviceAccountName: postgresql
      automountServiceAccountToken: true
      imagePullSecrets:
        - name: regcred
      containers:
        - name: s3proxy
          image: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
          imagePullPolicy: Always
          ports:
            - containerPort: 80
              name: http
              protocol: TCP
          env:
            - name: K8S_POD_UID
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.uid
            - name: K8S_POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
            - name: K8S_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: OTEL_RESOURCE_ATTRIBUTES
              value: k8s.pod.uid=$(K8S_POD_UID),k8s.pod.name=$(K8S_POD_NAME),k8s.namespace.name=$(K8S_NAMESPACE)
            - name: AWS_API_ENDPOINT
              value: https://storage.yandexcloud.net
            - name: AWS_S3_BUCKET
              value: prod-pg-dumps
            - name: AWS_REGION
              value: ru-central1
            - name: AWS_SHARED_CREDENTIALS_FILE
              value: /vault/secrets/aws-credentials
            - name: AWS_EC2_METADATA_DISABLED
              value: "true"
            - name: ACCESS_LOG
              value: "true"
            - name: CORS_ALLOW_HEADERS
              value: Content-Type, Accept-Ranges, Content-Range, Content-Encoding
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi