apiVersion: v1
kind: Pod
metadata:
  name: static-web
  namespace: test
  labels:
    role: .myrole
spec:
  serviceAccount: my-service-account
  hostPID: true
  hostIPC: true
  hostNetwork: true
  containers:
    - name: web
      image: nginx:latest
      securityContext:
        privileged: true
        runAsUser: 2000
      livenessProbe:
        httpGet:
          path: /health
          port: 8080
          httpHeaders:
            - name: Custom-Header
              value: Awesome
      readinessProbe:
        tcpSocket:
          port: 8080
        initialDelaySeconds: 5
        periodSeconds: 10
      resources:
        requests:
          cpu: "64Mi"
        limits:
          memory: "128Mi"
      ports:
        - name: web
          containerPort: 80
          protocol: TCP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: rss-site
  namespace: default
  labels:
    owner: test@datree.io
    app: web
spec:
  replicas: 1
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      namespace: test
      labels:
        app: web
    spec:
      restartPolicy: Never
      volumes:
        - name: docker-sock
          hostPath:
            path: /var/run/docker.sock
      containers:
        - name: front-end
          image: nginx@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
              httpHeaders:
                - name: Custom-Header
                  value: Awesome
          readinessProbe:
            tcpSocket:
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            requests:
              cpu: "64Mi"
            limits:
              memory: "128Mi"
          ports:
            - containerPort: 80
        - name: rss-reader
          image: nickchase/nginx@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
          securityContext:
            runAsUser: 100
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
              httpHeaders:
                - name: Custom-Header
                  value: Awesome
          readinessProbe:
            tcpSocket:
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            requests:
              memory: "64Mi"
              cpu: "64Mi"
            limits:
              memory: "128Mi"
              cpu: "500m"
          ports:
            - containerPort: 88
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-myservicea
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - host: "*"
    http:
      paths:
      - path: /
        backend:
          serviceName: myservicea
          servicePort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: my-service
  labels:
    owner: test@datree.io
spec:
  type: NodePort
  selector:
    app: MyApp
  ports:
    - protocol: TCP
      port: 80
      targetPort: 9376
---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: hello
  namespace: test
  labels:
    owner: test@datree.io
spec:
  schedule: "1 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          volumes:
            - name: docker-sock
              hostPath:
                path: /var/run/docker
          containers:
            - name: hello
              image: busybox
              imagePullPolicy: IfNotPresent
              command:
                - /bin/sh
                - -c
                - date; echo Hello from the Kubernetes cluster
          restartPolicy: OnFailure
---
apiVersion: autoscaling/v2beta2
kind: HorizontalPodAutoscaler
metadata:
  name: php-apache
spec:
  maxReplicas: 10
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: php-apache
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 50
---
apiVersion: rbac.authorization.k8s.io/v1alpha1
kind: ClusterRoleBinding
metadata:
    name: privilegedPSP
subjects:
- kind: Group
  apiVersion: rbac.authorization.k8s.io/v1alpha1
  name: privileged
roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: privilegedPSP
