eda-api.deployment.yaml.j2

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    {{ lookup("template", "../common/templates/labels/common.yaml.j2")  | indent(width=4) | trim }}
    {{ lookup("template", "../common/templates/labels/version.yaml.j2") | indent(width=4) | trim }}
    app.kubernetes.io/component: '{{ deployment_type }}-api'
  name: '{{ api_server_name }}'
  namespace: '{{ ansible_operator_meta.namespace }}'
spec:
  replicas: {{ combined_api.replicas }}
{% if combined_api.strategy is defined %}
  strategy:
    type: {{ combined_api.strategy.type }}
{% if combined_api.strategy.type == "Recreate" %}
    rollingUpdate: null
{% elif combined_api.strategy.type == "RollingUpdate" %}
    rollingUpdate:
      maxSurge:  {{ combined_api.strategy.rollingUpdate.maxSurge | default("25%")}}
      maxUnavailable: {{ combined_api.strategy.rollingUpdate.maxUnavailable | default("25%")}}
{% endif %}
{% endif %}
  selector:
    matchLabels:
      app.kubernetes.io/name: '{{ ansible_operator_meta.name }}'
      app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
      app.kubernetes.io/component: '{{ deployment_type }}-api'
  template:
    metadata:
      labels:
        {{ lookup("template", "../common/templates/labels/common.yaml.j2")  | indent(width=8) | trim }}
        {{ lookup("template", "../common/templates/labels/version.yaml.j2") | indent(width=8) | trim }}
        app.kubernetes.io/component: '{{ deployment_type }}-api'
      annotations:
        kubectl.kubernetes.io/default-container: 'eda-api'
{% for template in [
    "redirect-page.configmap",
  ] %}
        checksum-{{ template | replace('/', '-') }}: "{{ lookup('template', template + '.html.j2') | sha1 }}"
{% endfor %}
{% for template in [
    "eda.configmap",
  ] %}
        checksum-{{ template | replace('/', '-') }}: "{{ lookup('template', template + '.yaml.j2') | sha1 }}"
{% endfor %}
{% for secret in [
    "secrets/db_fields_encryption",
  ] %}
        checksum-secret-{{ secret }}: "{{ lookup('ansible.builtin.vars', secret, default='')["resources"][0]["data"] | default('') | sha1 }}"
{% endfor %}
    spec:
      serviceAccountName: '{{ ansible_operator_meta.name }}'
{% if image_pull_secrets | length > 0 %}
      imagePullSecrets:
{% for secret in image_pull_secrets %}
        - name: {{ secret }}
{% endfor %}
{% endif %}
{% if combined_api.node_selector is defined %}
      nodeSelector:
        {{ combined_api.node_selector | to_nice_yaml | indent(width=8) }}
{% endif %}
{% if combined_api.tolerations is defined %}
      tolerations:
        {{ combined_api.tolerations | to_nice_yaml | indent(width=8) }}
{% endif %}
{% if combined_api.topology_spread_constraints is defined %}
      topologySpreadConstraints:
        {{ combined_api.topology_spread_constraints | indent(width=8) }}
{% endif %}
      initContainers:
      - name: run-migrations
        image: {{ _image }}
        imagePullPolicy: '{{ image_pull_policy }}'
        command:
          - /bin/bash
          - -c
          - aap-eda-manage migrate
        envFrom:
          - configMapRef:
              name: '{{ ansible_operator_meta.name }}-{{ deployment_type }}-env-properties'
        env:
        - name: EDA_DB_HOST
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: host
        - name: EDA_ACTIVATION_DB_HOST
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: host
        - name: EDA_DB_NAME
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: database
        - name: EDA_DB_PORT
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: port
        - name: EDA_DB_USER
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: username
        - name: EDA_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: password
        - name: EDA_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: '{{ db_fields_encryption_secret_name }}'
              key: secret_key
{% if combined_api.resource_requirements is defined %}
        resources: {{ combined_api.resource_requirements }}
{% endif %}
      - name: eda-initial-data
        image: {{ _image }}
        imagePullPolicy: '{{ image_pull_policy }}'
        command: ["/bin/bash", "-c", "aap-eda-manage create_initial_data{% if not ui_disabled %} && aap-eda-manage collectstatic --noinput{% endif %}"]
        envFrom:
          - configMapRef:
              name: '{{ ansible_operator_meta.name }}-{{ deployment_type }}-env-properties'
        env:
        - name: ANSIBLE_REVERSE_RESOURCE_SYNC
          value: 'true'
        - name: EDA_DB_HOST
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: host
        - name: EDA_DB_NAME
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: database
        - name: EDA_DB_PORT
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: port
        - name: EDA_DB_USER
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: username
        - name: EDA_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: password
        - name: EDA_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: '{{ db_fields_encryption_secret_name }}'
              key: secret_key
{% if combined_api.resource_requirements is defined %}
        resources: {{ combined_api.resource_requirements }}
{% endif %}
{% if not ui_disabled %}
        volumeMounts:
          - name: static-files
            mountPath: {{ static_path }}
{% endif %}
{% if bundle_ca_crt  %}
      - name: configure-bundle-ca-cert
        image: {{ _image }}
        imagePullPolicy: '{{ image_pull_policy }}'
        command:
          - /bin/sh
          - -c
          - |
            mkdir -p /etc/pki/ca-trust/extracted/{java,pem,openssl,edk2}
            update-ca-trust
{% if combined_api.resource_requirements is defined %}
        resources: {{ combined_api.resource_requirements }}
{% endif %}
        volumeMounts:
          - name: "ca-trust-extracted"
            mountPath: "/etc/pki/ca-trust/extracted"
          - name: "{{ ansible_operator_meta.name }}-bundle-cacert"
            mountPath: /etc/pki/ca-trust/source/anchors/bundle-ca.crt
            subPath: bundle-ca.crt
            readOnly: true
{% endif %}
      containers:
      - name: eda-api
        image: {{ _image }}
        imagePullPolicy: '{{ image_pull_policy }}'
        args:
        - /bin/bash
        - -c
        - gunicorn --bind 0.0.0.0:{{ api_django_port }} --workers {{ combined_api.gunicorn_workers }} aap_eda.wsgi:application
        envFrom:
          - configMapRef:
              name: '{{ ansible_operator_meta.name }}-{{ deployment_type }}-env-properties'
        env:
        - name: EDA_DB_HOST
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: host
        - name: EDA_DB_NAME
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: database
        - name: EDA_DB_PORT
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: port
        - name: EDA_DB_USER
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: username
        - name: EDA_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: password
        - name: EDA_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: '{{ db_fields_encryption_secret_name }}'
              key: secret_key
        - name: EDA_ACTIVATION_DB_HOST
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: host
        - name: EDA_MQ_HOST
          valueFrom:
            secretKeyRef:
              name: '{{ redis_config_secret }}'
              key: host
        - name: EDA_MQ_PORT
          valueFrom:
            secretKeyRef:
              name: '{{ redis_config_secret }}'
              key: port
        - name: EDA_MQ_USER
          valueFrom:
            secretKeyRef:
              name: '{{ redis_config_secret }}'
              key: username
        - name: EDA_MQ_USER_PASSWORD
          valueFrom:
            secretKeyRef:
              name: '{{ redis_config_secret }}'
              key: password
        - name: EDA_MQ_TLS
          valueFrom:
            secretKeyRef:
              name: '{{ redis_config_secret }}'
              key: redis_tls
              optional: true
        - name: EDA_MQ_REDIS_HA_CLUSTER_HOSTS
          valueFrom:
            secretKeyRef:
              name: '{{ redis_config_secret }}'
              key: cluster_endpoint
              optional: true
        ports:
        - containerPort: {{ api_django_port }}
        readinessProbe:
          httpGet:
            path: /_healthz
            port: {{ api_django_port }}
          failureThreshold: 10
          periodSeconds: 10
          initialDelaySeconds: 20
        livenessProbe:
          httpGet:
            path: /_healthz
            port: {{ api_django_port }}
          failureThreshold: 10
          periodSeconds: 10
          initialDelaySeconds: 20
{% if combined_api.resource_requirements is defined %}
        resources: {{ combined_api.resource_requirements }}
{% endif %}
{% if not ui_disabled %}
        volumeMounts:
        - name: static-files
          mountPath: {{ static_path }}
{% endif %}
      - name: daphne
        image: {{ _image }}
        imagePullPolicy: '{{ image_pull_policy }}'
        args:
        - /bin/bash
        - -c
        - daphne -b 0.0.0.0 -p {{ websocket_port }} aap_eda.asgi:application
        envFrom:
          - configMapRef:
              name: '{{ ansible_operator_meta.name }}-{{ deployment_type }}-env-properties'
        env:
        - name: EDA_DB_HOST
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: host
        - name: EDA_DB_NAME
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: database
        - name: EDA_DB_PORT
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: port
        - name: EDA_DB_USER
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: username
        - name: EDA_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: '{{ __database_secret }}'
              key: password
        - name: EDA_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: '{{ db_fields_encryption_secret_name }}'
              key: secret_key
        - name: EDA_MQ_HOST
          valueFrom:
            secretKeyRef:
              name: '{{ redis_config_secret }}'
              key: host
        - name: EDA_MQ_PORT
          valueFrom:
            secretKeyRef:
              name: '{{ redis_config_secret }}'
              key: port
        - name: EDA_MQ_USER
          valueFrom:
            secretKeyRef:
              name: '{{ redis_config_secret }}'
              key: username
        - name: EDA_MQ_USER_PASSWORD
          valueFrom:
            secretKeyRef:
              name: '{{ redis_config_secret }}'
              key: password
        - name: EDA_MQ_TLS
          valueFrom:
            secretKeyRef:
              name: '{{ redis_config_secret }}'
              key: redis_tls
              optional: true
        - name: EDA_MQ_REDIS_HA_CLUSTER_HOSTS
          valueFrom:
            secretKeyRef:
              name: '{{ redis_config_secret }}'
              key: cluster_endpoint
              optional: true
{% if combined_api.resource_requirements is defined %}
        resources: {{ combined_api.resource_requirements }}
{% endif %}
{% if bundle_ca_crt %}
        volumeMounts:
          - name: "ca-trust-extracted"
            mountPath: "/etc/pki/ca-trust/extracted"
          - name: "{{ ansible_operator_meta.name }}-bundle-cacert"
            mountPath: /etc/pki/ca-trust/source/anchors/bundle-ca.crt
            subPath: bundle-ca.crt
            readOnly: true
{% endif %}
      - name: nginx
        image: {{ _image_web }}
        ports:
          - containerPort: {{ api_nginx_port }}
        volumeMounts:
{% if not ui_disabled %}
          - name: static-files
            mountPath: '{{ static_path }}'
{% else %}
{% if public_base_url is defined %}
          - name: redirect-page
            mountPath: '{{ static_path }}/index.html'
            subPath: redirect-page.html
{% endif %}
{% endif %}
          - name: '{{ ansible_operator_meta.name }}-nginx-api-conf'
            mountPath: /etc/nginx/nginx.conf
            subPath: nginx.conf
            readOnly: true
          - name: nginx-cache
            mountPath: /var/cache/nginx
          - name: nginx-run
            mountPath: /var/run
      restartPolicy: Always

      volumes:
{% if not ui_disabled %}
        - name: static-files
          emptyDir: {}
{% else %}
{% if public_base_url is defined %}
        - name: redirect-page
          configMap:
            name: '{{ ansible_operator_meta.name }}-redirect-page'
            items:
              - key: redirect-page.html
                path: redirect-page.html
{% endif %}
{% endif %}
        - name: '{{ ansible_operator_meta.name }}-nginx-api-conf'
          configMap:
            name: '{{ ansible_operator_meta.name }}-nginx-api-configmap'
            items:
              - key: nginx_api_default_conf_template
                path: nginx.conf
        - name: nginx-cache
          emptyDir: {}
        - name: nginx-run
          emptyDir: {}
{% if bundle_ca_crt %}
        - name: "ca-trust-extracted"
          emptyDir: {}
        - name: "{{ ansible_operator_meta.name }}-bundle-cacert"
          secret:
            secretName: "{{ bundle_cacert_secret }}"
            items:
              - key: bundle-ca.crt
                path: 'bundle-ca.crt'
{% endif %}