kind: Service
metadata:
  name: ratelimit-tls
  namespace: ext-ratelimit
  labels:
    app: ratelimit-tls
spec:
  ports:
    - name: http
      port: 8080
      targetPort: 8080 # Doesn't go through Envoy
    - name: grpc-insecure
      port: 18080
      targetPort: 18080
    - name: grpc-tls
      port: 18443
      targetPort: 18443
  selector:
    app: ratelimit-tls
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ratelimit-tls
  namespace: ext-ratelimit
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ratelimit-tls
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: ratelimit-tls
    spec:
      containers:
        - name: envoy-proxy
          image: envoyproxy/envoy-alpine:v1.18.4
          imagePullPolicy: Always
          command:
            - '/usr/local/bin/envoy'
          args:
            - '--config-path /etc/envoy/config.yaml'
            - '--mode serve'
            - '--service-cluster ext-ratelimit'
          ports:
            - name: grpc-plaintext
              containerPort: 18080
            - name: grpc-tls
              containerPort: 18443
          volumeMounts:
            - name: proxy-config
              mountPath: /etc/envoy
            - name: proxy-certs
              mountPath: /certs
        - name: ratelimit
          image: envoyproxy/ratelimit:6f5de117 # 2021/01/08
          imagePullPolicy: Always
          command: ['/bin/ratelimit']
          env:
            - name: LOG_LEVEL
              value: debug
            - name: REDIS_SOCKET_TYPE
              value: tcp
            - name: REDIS_URL
              value: redis:6379
            - name: USE_STATSD
              value: 'false'
            - name: RUNTIME_ROOT
              value: /data
            - name: RUNTIME_SUBDIRECTORY
              value: ratelimit
          ports:
            - containerPort: 8080
            - containerPort: 8081
            - containerPort: 6070
          volumeMounts:
            - name: ratelimit-config
              mountPath: /data/ratelimit/config/config.yaml
              subPath: config.yaml
      volumes:
        - name: ratelimit-config
          configMap:
            name: ratelimit-config
        - name: proxy-certs
          secret:
            secretName: ratelimit-certs
        - name: proxy-config
          configMap:
            name: ratelimit-proxy
