apiVersion: v1
kind: ServiceAccount
metadata:
  name: metapi-deploy-helper
  namespace: ai
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: metapi-deploy-helper-admin
  namespace: ai
subjects:
  - kind: ServiceAccount
    name: metapi-deploy-helper
    namespace: ai
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin
---
apiVersion: v1
kind: Secret
metadata:
  name: metapi-deploy-helper-auth
  namespace: ai
type: Opaque
stringData:
  DEPLOY_HELPER_TOKEN: replace-with-a-shared-long-random-token
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: metapi-deploy-helper
  namespace: ai
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: metapi-deploy-helper
  template:
    metadata:
      labels:
        app.kubernetes.io/name: metapi-deploy-helper
    spec:
      serviceAccountName: metapi-deploy-helper
      containers:
        - name: helper
          image: 1467078763/metapi:latest
          imagePullPolicy: Always
          command: ["/bin/sh", "-lc"]
          args:
            - |
              TOKEN="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
              NAMESPACE="$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)"
              cat >/tmp/kubeconfig <<EOF
              apiVersion: v1
              kind: Config
              clusters:
              - name: in-cluster
                cluster:
                  certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
                  server: https://kubernetes.default.svc
              contexts:
              - name: in-cluster
                context:
                  cluster: in-cluster
                  namespace: ${NAMESPACE}
                  user: helper
              current-context: in-cluster
              users:
              - name: helper
                user:
                  token: ${TOKEN}
              EOF
              export KUBECONFIG=/tmp/kubeconfig
              exec npm run start:deploy-helper
          ports:
            - containerPort: 9850
              name: http
          env:
            - name: DEPLOY_HELPER_HOST
              value: 0.0.0.0
            - name: DEPLOY_HELPER_PORT
              value: "9850"
            - name: DEPLOY_HELPER_TOKEN
              valueFrom:
                secretKeyRef:
                  name: metapi-deploy-helper-auth
                  key: DEPLOY_HELPER_TOKEN
          readinessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 15
            periodSeconds: 20
          volumeMounts:
            - name: metapi-chart
              mountPath: /opt/metapi-k3s/chart
              readOnly: true
      volumes:
        - name: metapi-chart
          hostPath:
            path: /opt/metapi-k3s/chart
            type: Directory
---
apiVersion: v1
kind: Service
metadata:
  name: metapi-deploy-helper
  namespace: ai
spec:
  selector:
    app.kubernetes.io/name: metapi-deploy-helper
  ports:
    - name: http
      port: 9850
      targetPort: http