---
apiVersion: v1
kind: Pod
metadata:
  name: pass-governance-best-practices-for-pod
  labels:
    environment: prod
    app: test
    owner: test-at-datree.io
spec:
  containers:
    - name: nginx
      image: nginx:1.14.2
      ports:
        - containerPort: 80
      resources:
        requests:
          cpu: "175m"
          memory: "768Mi"
        limits:
          cpu: "750m"
          memory: "3072Mi"
      securityContext:
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        runAsUser: 1000
        runAsNonRoot: true
      volumeMounts:
        - name: test-volume
          mountPath: /test/dev
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: pass-governance-best-practices-for-deployment
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: app
                      operator: In
                      values:
                        - nginx
                topologyKey: kubernetes.io/hostname
      containers:
        - name: nginx
          image: nginx:1.14.2
          ports:
            - containerPort: 80
          resources:
            requests:
              cpu: "175m"
              memory: "768Mi"
            limits:
              cpu: "750m"
              memory: "3072Mi"
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            runAsUser: 1000
            runAsNonRoot: true
          volumeMounts:
            - name: test-volume
              mountPath: /test/dev
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: pass-governance-best-practices-for-ingress
spec:
  rules:
    - host: test.example.com
      http:
        paths:
          - pathType: ImplementationSpecific
            path: /
            backend:
              service:
                name: nginx
                port:
                  number: 80
