apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment
spec:
  replicas: 1
  template:
    spec:
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: jupyter-web-app
        image: ghcr.io/kubeflow/kubeflow/jupyter-web-app
        ports:
        - containerPort: 5000
        volumeMounts:
        - mountPath: /etc/config
          name: config-volume
        - mountPath: /src/apps/default/static/assets/logos
          name: logos-volume
        env:
        - name: APP_PREFIX
          value: $(JWA_PREFIX)
        - name: UI
          value: $(JWA_UI)
        - name: USERID_HEADER
          value: $(JWA_USERID_HEADER)
        - name: USERID_PREFIX
          value: $(JWA_USERID_PREFIX)
        - name: APP_SECURE_COOKIES
          value: $(JWA_APP_SECURE_COOKIES)
        - name: METRICS
          value: $(JWA_APP_ENABLE_METRICS)
        securityContext:
          runAsNonRoot: true
          allowPrivilegeEscalation: false
          runAsUser: 1000
          capabilities:
            drop:
            - ALL
      serviceAccountName: service-account
      volumes:
      - configMap:
          name: config
        name: config-volume
      - configMap:
          name: jupyter-web-app-logos
        name: logos-volume
