deployment.yaml

# Heavily borrowed from:
# https://learnk8s.io/microservices-authentication-kubernetes

apiVersion: v1
kind: Namespace
metadata:
  name: k8s-http-auth-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: api
  namespace: k8s-http-auth-system
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  namespace: k8s-http-auth-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      serviceAccount: api
      volumes:
        - name: api-token
          projected:
            sources:
              - serviceAccountToken:
                  path: api-token
                  expirationSeconds: 600
                  audience: api-db
      containers:
        - name: api
          image: k8s-http-auth/api:local
          ports:
          - containerPort: 8080
          volumeMounts:
            - mountPath: /var/run/secrets/tokens
              name: api-token
---
apiVersion: v1
kind: Service
metadata:
  name: api
  namespace: k8s-http-auth-system
spec:
  type: NodePort
  selector:
    app: api
  ipFamilyPolicy: SingleStack
  ipFamilies:
    - IPv4
  ports:
    - name: http
      appProtocol: http
      nodePort: 31881
      port: 8080
      protocol: TCP
      targetPort: 8080
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: db
  namespace: k8s-http-auth-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: db:system:auth-delegator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    name: db
    namespace: k8s-http-auth-system
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: db
  namespace: k8s-http-auth-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: db
  template:
    metadata:
      labels:
        app: db
    spec:
      serviceAccount: db
      containers:
        - name: db
          image: k8s-http-auth/db:local
          ports:
          - containerPort: 9090
---
apiVersion: v1
kind: Service
metadata:
  name: db
  namespace: k8s-http-auth-system
spec:
  type: ClusterIP
  selector:
    app: db
  ports:
    - port: 9090
      targetPort: 9090