apiVersion: apps/v1
kind: Deployment
metadata: {name: kab-ingestion}
spec:
  replicas: 2
  selector: {matchLabels: {app: kab-ingestion}}
  template:
    metadata: {labels: {app: kab-ingestion}}
    spec:
      containers:
        - name: ingestion
          image: registry.example/kab-ingestion:${GIT_SHA}
          env:
            - name: CONFIG_PATH
              value: /etc/kab/config.yaml
          readinessProbe: {httpGet: {path: /health, port: 8080}}
          securityContext: {allowPrivilegeEscalation: false, readOnlyRootFilesystem: true}