# Minimal starter to run step-ca in a containerized lab.
# Initialize configuration and provisioners first with the step CLI.
apiVersion: v1
kind: ConfigMap
metadata:
  name: step-ca-note
  namespace: security

data:
  README: |
    1. Initialize step-ca outside the cluster or in a one-shot job.
    2. Mount the generated config/ and cert material into the container.
    3. Prefer an offline root and an online intermediate for real deployments.
    4. Expose ACME or other provisioners only to the clients that need them.
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: step-ca
  namespace: security
spec:
  replicas: 1
  selector:
    matchLabels:
      app: step-ca
  template:
    metadata:
      labels:
        app: step-ca
    spec:
      containers:
        - name: step-ca
          image: smallstep/step-ca:latest
          args: ["/home/step/config/ca.json"]
          ports:
            - containerPort: 9000
          volumeMounts:
            - name: step-ca-config
              mountPath: /home/step
              readOnly: true
      volumes:
        - name: step-ca-config
          secret:
            secretName: step-ca-config
