apiVersion: v1
kind: ConfigMap
metadata: {name: reader-config}
data: {MODEL_TIMEOUT: "90"}
---
apiVersion: v1
kind: LimitRange
metadata: {name: reader-defaults}
spec:
  limits:
    - type: Container
      defaultRequest: {cpu: 10m, memory: 16Mi}
      default: {cpu: 500m, memory: 128Mi}
---
apiVersion: v1
kind: ResourceQuota
metadata: {name: reader-budget}
spec:
  hard: {pods: "4", requests.cpu: "1", requests.memory: 256Mi}
---
apiVersion: v1
kind: ServiceAccount
metadata: {name: reader}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: read-model}
rules: [{apiGroups: [""], resources: [pods], verbs: [get, list, watch]}]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: {name: read-model}
roleRef: {apiGroup: rbac.authorization.k8s.io, kind: Role, name: read-model}
subjects: [{kind: ServiceAccount, name: reader}]
---
apiVersion: apps/v1
kind: Deployment
metadata: {name: reader}
spec:
  replicas: 1
  selector: {matchLabels: {app: reader}}
  template:
    metadata: {labels: {app: reader}}
    spec:
      serviceAccountName: reader
      automountServiceAccountToken: false
      containers:
        - name: model
          image: modeldock-cpu:lab
          imagePullPolicy: IfNotPresent
          envFrom: [{configMapRef: {name: reader-config}}]
          ports: [{name: http, containerPort: 80}]
          startupProbe: {tcpSocket: {port: http}, periodSeconds: 2, failureThreshold: 30}
          readinessProbe: {tcpSocket: {port: http}, periodSeconds: 4}
          livenessProbe: {tcpSocket: {port: http}, periodSeconds: 10}
---
apiVersion: v1
kind: Service
metadata: {name: reader}
spec:
  selector: {app: reader}
  ports: [{name: http, port: 80, targetPort: http}]
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata: {name: reader}
spec: {minAvailable: 1, selector: {matchLabels: {app: reader}}}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: same-namespace-readers}
spec:
  podSelector: {matchLabels: {app: reader}}
  policyTypes: [Ingress]
  ingress: [{from: [{podSelector: {matchLabels: {access: model}}}], ports: [{protocol: TCP, port: 80}]}]