apiVersion: apps/v1
kind: Deployment
metadata:
  name: backstage # placeholder for 'backstage-<cr-name>'
spec:
  replicas: 1
  selector:
    matchLabels:
      rhdh.redhat.com/app:  # placeholder for 'backstage-<cr-name>'
  template:
    metadata:
      labels:
        rhdh.redhat.com/app:  # placeholder for 'backstage-<cr-name>'
    spec:
      automountServiceAccountToken: false
      # if securityContext not present in AKS/EKS, the error is like this:
      #Error: EACCES: permission denied, open '/dynamic-plugins-root/backstage-plugin-scaffolder-backend-module-github-dynamic-0.2.2.tgz'
      # fsGroup doesn not work for Openshift
      #securityContext:
      #   fsGroup: 1001
      volumes:
        - ephemeral:
            volumeClaimTemplate:
              spec:
                accessModes:
                  - ReadWriteOnce
                resources:
                  requests:
                    storage: 2Gi
          name: dynamic-plugins-root
        - name: dynamic-plugins-npmrc
          secret:
            defaultMode: 420
            optional: true
            secretName: dynamic-plugins-npmrc
      initContainers:
        - name: install-dynamic-plugins
          command:
            - ./install-dynamic-plugins.sh
            - /dynamic-plugins-root
          image: quay.io/janus-idp/backstage-showcase:latest # will be replaced with the actual image quay.io/janus-idp/backstage-showcase:next
          imagePullPolicy: IfNotPresent
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
          env:
            - name: NPM_CONFIG_USERCONFIG
              value: /opt/app-root/src/.npmrc.dynamic-plugins
          volumeMounts:
            - mountPath: /dynamic-plugins-root
              name: dynamic-plugins-root
            - mountPath: /opt/app-root/src/.npmrc.dynamic-plugins
              name: dynamic-plugins-npmrc
              readOnly: true
              subPath: .npmrc
          workingDir: /opt/app-root/src
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              cpu: 1000m
              memory: 2.5Gi
              ephemeral-storage: 5Gi
      containers:
        - name: backstage-backend
          # image will be replaced by the value of the `RELATED_IMAGE_backstage` env var, if set
          image: quay.io/janus-idp/backstage-showcase:latest
          imagePullPolicy: IfNotPresent
          args:
            - "--config"
            - "dynamic-plugins-root/app-config.dynamic-plugins.yaml"
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthcheck
              port: 7007
              scheme: HTTP
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 2
            timeoutSeconds: 2
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthcheck
              port: 7007
              scheme: HTTP
            initialDelaySeconds: 60
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          ports:
            - name: backend
              containerPort: 7007
          env:
            - name: APP_CONFIG_backend_listen_port
              value: "7007"
          volumeMounts:
            - mountPath: /opt/app-root/src/dynamic-plugins-root
              name: dynamic-plugins-root
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              cpu: 1000m
              memory: 2.5Gi
              ephemeral-storage: 5Gi