resource "kubernetes_deployment" "pushgateway" {
  metadata {
    name      = "pushgateway"
    namespace = kubernetes_namespace.prometheus.metadata[0].name
    labels = {
      app = "pushgateway"
    }
  }

  spec {
    replicas = 1
    strategy {
      type = "Recreate"
    }

    selector {
      match_labels = {
        app = "pushgateway"
      }
    }

    template {
      metadata {
        labels = {
          app = "pushgateway"
        }
        annotations = {
          "prometheus.io/scrape" = "true"
          "prometheus.io/port"   = "9091"
        }
      }

      spec {
        automount_service_account_token = false

        security_context {
          run_as_non_root = true
          run_as_user     = 65534
          run_as_group    = 65534
          seccomp_profile {
            type = "RuntimeDefault"
          }
        }

        container {
          name  = "pushgateway"
          image = "prom/pushgateway:${local.app_version}"
          args  = ["--persistence.file=/pushgateway/metrics"]

          port {
            name           = "http"
            container_port = 9091
          }

          security_context {
            run_as_non_root            = true
            run_as_user                = 65534
            run_as_group               = 65534
            allow_privilege_escalation = false
            privileged                 = false
            read_only_root_filesystem  = true
            capabilities {
              drop = ["ALL"]
            }
          }

          volume_mount {
            name       = "pushgateway-storage-volume"
            mount_path = "/pushgateway"
          }
        }

        volume {
          name = "pushgateway-storage-volume"
          host_path {
            path = local.pushgateway_folder
            type = "DirectoryOrCreate"
          }
        }
      }
    }
  }
}

resource "kubernetes_service" "pushgateway" {
  metadata {
    name      = "pushgateway"
    namespace = kubernetes_namespace.prometheus.metadata[0].name
  }

  spec {
    selector = {
      app = "pushgateway"
    }
    type = "ClusterIP"

    port {
      port        = 9091
      protocol    = "TCP"
      target_port = "http"
    }
  }
}