# homa — a workload that runs here as-is.
#
#   kubectl apply -f https://homa.li/en/hello.yaml
#
# Every namespace on homa enforces Kubernetes PodSecurity `restricted`. The
# four securityContext fields below are what that requires. Without them the
# Deployment is still created — and never produces a single Pod. Copy them
# into your own manifests.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
spec:
  replicas: 1
  selector:
    matchLabels: { app: hello }
  template:
    metadata:
      labels: { app: hello }
    spec:
      securityContext:
        runAsNonRoot: true                  # 1
        seccompProfile: { type: RuntimeDefault }   # 2
      containers:
        - name: web
          # Runs as an unprivileged user and listens on 8080, not 80.
          # A stock `nginx` image cannot satisfy runAsNonRoot.
          image: nginxinc/nginx-unprivileged:alpine
          ports:
            - containerPort: 8080
          securityContext:
            allowPrivilegeEscalation: false  # 3
            capabilities: { drop: [ALL] }    # 4
          resources:
            requests: { cpu: 10m, memory: 32Mi }
            limits:   { cpu: 200m, memory: 128Mi }
---
apiVersion: v1
kind: Service
metadata:
  name: hello
spec:
  selector: { app: hello }
  ports:
    - port: 80
      targetPort: 8080