apiVersion: v1
kind: Service
metadata:
  labels:
    app: mtls-echo
  name: mtls-echo
spec:
  selector:
    app: mtls-echo
  type: ClusterIP
  ports:
  - name: https
    protocol: TCP
    port: 8443
    targetPort: 8443
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mtls-echo-v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mtls-echo
      version: v1
  template:
    metadata:
      labels:
        app: mtls-echo
        version: v1
    spec:
      containers:
        - args:
          - --metrics=15014
          - --port
          - "3333"
          - --port
          - "8080"
          - --port
          - "8443"
          - --mtls
          - "8443"
          - --version
          - v1
          - --crt=/cert.crt
          - --key=/cert.key
          env:
          - name: INSTANCE_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP
          image: gcr.io/istio-testing/app:latest
          imagePullPolicy: Always
          livenessProbe:
            failureThreshold: 10
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: tcp-health-port
            timeoutSeconds: 1
          name: app
          ports:
          - containerPort: 3333
            name: tcp-health-port
            protocol: TCP
          - containerPort: 8080
            protocol: TCP
          - containerPort: 8443
            protocol: TCP
          readinessProbe:
            failureThreshold: 10
            httpGet:
              path: /
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 1
          startupProbe:
            failureThreshold: 10
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: tcp-health-port
            timeoutSeconds: 1
          volumeMounts:
          - name: certs
            mountPath: /certs
          - name: ca-certs
            mountPath: /etc/certs/ca.crt
      volumes:
      - name: certs
        secret:
          secretName: mtls-echo-certs
      - name: ca
        secret:
          secretName: mtls-echo-ca
