a13labs.infra/terraform/modules/apps/template/main.tf

resource "kubernetes_namespace" "app" {
  metadata {
    name = "app"
  }
}

resource "kubernetes_service_account" "app" {

  metadata {
    name      = "app-sa"
    namespace = kubernetes_namespace.app.metadata[0].name
  }

  automount_service_account_token = false
}

resource "kubernetes_config_map" "app_config" {
  metadata {
    name      = "app-config"
    namespace = kubernetes_namespace.app.metadata[0].name
  }

  data = {}
}

resource "kubernetes_secret" "app_secrets" {
  metadata {
    name      = "app-keys"
    namespace = kubernetes_namespace.app.metadata[0].name
  }

  data = {}
}

resource "kubernetes_deployment" "app" {
  metadata {
    name      = "app"
    namespace = kubernetes_namespace.app.metadata[0].name
    labels = {
      app = "app"
    }
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        app = "app"
      }
    }

    strategy {
      type = "Recreate"
    }

    template {
      metadata {
        labels = {
          app = "app"
        }
      }

      spec {
        service_account_name            = kubernetes_service_account.app.metadata[0].name
        automount_service_account_token = false

        container {
          name  = "app-container"
          image = "app/app-server-s6:${local.app_version}"

          env_from {
            config_map_ref {
              name = kubernetes_config_map.app_config.metadata[0].name
            }
          }

          security_context {
            allow_privilege_escalation = false
          }

          port {
            name           = "app-port-1"
            container_port = 21115
            host_port      = 21115
            protocol       = "TCP"
          }


          volume_mount {
            name       = "app-data"
            mount_path = "/data"
          }

          volume_mount {
            name       = "app-secrets"
            mount_path = "/data/secrets"
            read_only  = true
          }

          volume_mount {
            name       = "app-config"
            mount_path = "/data/config"
            read_only  = true
          }
        }

        volume {
          name = "app-data"
          host_path {
            path = local.app_path
          }
        }

        volume {
          name = "app-secrets"
          secret {
            secret_name = kubernetes_secret.app_secrets.metadata[0].name
          }
        }

        volume {
          name = "app-config"
          config_map {
            name = kubernetes_config_map.app_config.metadata[0].name
          }
        }

      }
    }
  }
}

resource "kubernetes_service" "app" {
  metadata {
    name      = "app-ports"
    namespace = kubernetes_namespace.app.metadata[0].name
  }

  spec {
    selector = {
      app = "app"
    }

    port {
      name        = "app-port-1"
      port        = 21115
      target_port = 21115
    }

    cluster_ip = "None"
  }

  lifecycle {
    ignore_changes = [
      metadata[0].annotations
    ]
  }

}