apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment
spec:
  replicas: 1
  template:
    spec:
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: volumes-web-app
        image: ghcr.io/kubeflow/kubeflow/volumes-web-app
        ports:
        - containerPort: 5000
        env:
        - name: APP_PREFIX
          value: $(VWA_PREFIX)
        - name: USERID_HEADER
          value: $(VWA_USERID_HEADER)
        - name: USERID_PREFIX
          value: $(VWA_USERID_PREFIX)
        - name: APP_SECURE_COOKIES
          value: $(VWA_APP_SECURE_COOKIES)
        - name: VOLUME_VIEWER_IMAGE
          value: filebrowser/filebrowser:v2.25.0
        - name: METRICS
          value: $(VWA_APP_ENABLE_METRICS)
        securityContext:
          runAsNonRoot: true
          allowPrivilegeEscalation: false
          runAsUser: 1000
          capabilities:
            drop:
            - ALL
        volumeMounts: 
        - name: viewer-spec
          mountPath: /etc/config/viewer-spec.yaml
          subPath: viewer-spec.yaml 
      serviceAccountName: service-account
      volumes: 
      - name: viewer-spec
        configMap: 
          name: viewer-spec
