apiVersion: apps/v1
kind: Deployment
metadata:
  name: unbound
  namespace: dns
spec:
  selector:
    matchLabels:
      app: unbound
  template:
    metadata:
      labels:
        app: unbound
    spec:
      #securityContext:
      #  seccompProfile:
      #    type: RuntimeDefault
      containers:
        - name: unbound
          image: docker.io/mvance/unbound:1.22.0  # renovate: docker=docker.io/mvance/unbound
          #securityContext:
          #  allowPrivilegeEscalation: false
          #  readOnlyRootFilesystem: false
          ports:
            - name: unbound-dns-tcp
              containerPort: 5335
              protocol: TCP
            - name: unbound-dns-udp
              containerPort: 5335
              protocol: UDP
          resources:
            requests:
              cpu: 10m
              memory: 64Mi
            limits:
              cpu: 500m
              memory: 128Mi
          startupProbe:
            exec:
              command: [ 'drill', '@127.0.0.1', '-p', '53', 'nrk.no' ]
            initialDelaySeconds: 10
            failureThreshold: 3
            timeoutSeconds: 5
          volumeMounts:
            - name: config
              mountPath: /opt/unbound/etc/unbound/unbound.conf
              subPath: unbound.conf
            - name: a-records
              mountPath: /opt/unbound/etc/unbound/a-records.conf
              subPath: a-records.conf
            - name: forward-records
              mountPath: /opt/unbound/etc/unbound/forward-records.conf
              subPath: forward-records.conf
            - name: srv-records
              mountPath: /opt/unbound/etc/unbound/srv-records.conf
              subPath: srv-records.conf
      volumes:
        - name: config
          configMap:
            name: unbound-config
            items: [ { key: unbound.conf.default, path: unbound.conf } ]
        - name: a-records
          configMap: { name: unbound-a-records }
        - name: forward-records
          configMap: { name: unbound-forward-records }
        - name: srv-records
          configMap: { name: unbound-srv-records }