apiVersion: v1
kind: ServiceAccount
metadata: {name: orders-worker, namespace: orders}
automountServiceAccountToken: false
---
apiVersion: apps/v1
kind: Deployment
metadata: {name: orders-worker, namespace: orders}
spec:
  replicas: 3
  minReadySeconds: 10
  revisionHistoryLimit: 3
  strategy:
    rollingUpdate: {maxSurge: 1, maxUnavailable: 0}
  selector:
    matchLabels: {app.kubernetes.io/name: orders-worker}
  template:
    metadata:
      labels: {app.kubernetes.io/name: orders-worker}
    spec:
      serviceAccountName: orders-worker
      terminationGracePeriodSeconds: 120
      securityContext: {runAsNonRoot: true, seccompProfile: {type: RuntimeDefault}}
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels: {app.kubernetes.io/name: orders-worker}
      containers:
        - name: worker
          image: REPLACE_WORKER_IMAGE_AT_DIGEST
          command: [/app/worker]
          envFrom: [{secretRef: {name: orders-worker-runtime}}]
          resources:
            requests: {cpu: 500m, memory: 512Mi}
            limits: {cpu: '2', memory: 1Gi}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: [ALL]}
          startupProbe:
            exec: {command: [/app/healthcheck, startup]}
            periodSeconds: 5
            failureThreshold: 30
          readinessProbe:
            exec: {command: [/app/healthcheck, ready]}
            periodSeconds: 5
          livenessProbe:
            exec: {command: [/app/healthcheck, live]}
            periodSeconds: 10
            failureThreshold: 3
          volumeMounts: [{name: tmp, mountPath: /tmp}]
      volumes: [{name: tmp, emptyDir: {sizeLimit: 256Mi}}]
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata: {name: orders-worker, namespace: orders}
spec:
  minAvailable: 2
  selector:
    matchLabels: {app.kubernetes.io/name: orders-worker}