deployment.yaml

{{- $fullName := include "cryostat.fullname" . -}}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "cryostat.fullname" . }}
  labels:
    {{- include "cryostat.labels" . | nindent 4 }}
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      {{- include "cryostat.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "cryostat.selectorLabels" . | nindent 8 }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "cryostat.serviceAccountName" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
        {{- if (.Values.authentication.openshift).enabled }}
        {{- include "openshiftOauthProxy" . | nindent 8 }}
        {{- else }}
        {{- include "oauth2Proxy" . | nindent 8 }}
        {{- end }}
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.core.securityContext | nindent 12 }}
          image: "{{ .Values.core.image.repository }}:{{ .Values.core.image.tag }}"
          imagePullPolicy: {{ .Values.core.image.pullPolicy }}
          env:
          - name: QUARKUS_HTTP_HOST
            value: localhost
          - name: QUARKUS_HTTP_PORT
            value: "8181"
          - name: QUARKUS_HTTP_PROXY_PROXY_ADDRESS_FORWARDING
            value: 'true'
          - name: QUARKUS_HTTP_PROXY_ALLOW_X_FORWARDED
            value: 'true'
          - name: QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_HOST
            value: 'true'
          - name: QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_PREFIX
            value: 'true'
          - name: QUARKUS_HIBERNATE_ORM_DATABASE_GENERATION
            value: drop-and-create
          - name: QUARKUS_DATASOURCE_USERNAME
            value: cryostat3
          - name: QUARKUS_DATASOURCE_PASSWORD
            valueFrom:
              secretKeyRef:
                name: {{ printf "%s-db-connection-key" .Release.Name }}
                key: CONNECTION_KEY
                optional: false
          - name: QUARKUS_DATASOURCE_JDBC_URL
            value: jdbc:postgresql://localhost:5432/cryostat3
          - name: STORAGE_BUCKETS_ARCHIVES_NAME
            value: archivedrecordings
          - name: QUARKUS_S3_ENDPOINT_OVERRIDE
            value: http://localhost:8333
          - name: QUARKUS_S3_PATH_STYLE_ACCESS
            value: "true"
          - name: QUARKUS_S3_AWS_REGION
            value: us-east-1
          - name: QUARKUS_S3_AWS_CREDENTIALS_TYPE
            value: static
          - name: QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_ACCESS_KEY_ID
            value: cryostat
          - name: AWS_ACCESS_KEY_ID
            value: $(QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_ACCESS_KEY_ID)
          - name: QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: {{ printf "%s-storage-secret-key" .Release.Name }}
                key: SECRET_KEY
                optional: false
          - name: AWS_SECRET_ACCESS_KEY
            value: $(QUARKUS_S3_AWS_CREDENTIALS_STATIC_PROVIDER_SECRET_ACCESS_KEY)
          - name: GRAFANA_DATASOURCE_URL
            value: http://localhost:8800
          - name: GRAFANA_DASHBOARD_URL
            value: http://localhost:3000
          - name: GRAFANA_DASHBOARD_EXT_URL
            value: /grafana/
          {{- if .Values.core.discovery.kubernetes.enabled }}
          - name: CRYOSTAT_DISCOVERY_KUBERNETES_ENABLED
            value: "true"
          {{- with .Values.core.discovery.kubernetes }}
          - name: CRYOSTAT_DISCOVERY_KUBERNETES_NAMESPACES
            value: {{ include "cryostat.commaSepList" (list .namespaces $.Release.Namespace .installNamespaceDisabled) }}
          - name: CRYOSTAT_DISCOVERY_KUBERNETES_PORT_NAMES
            value: {{ include "cryostat.commaSepList" (list .portNames "jfr-jmx" .builtInPortNamesDisabled) }}
          - name: CRYOSTAT_DISCOVERY_KUBERNETES_PORT_NUMBERS
            value: {{ include "cryostat.commaSepList" (list .portNumbers 9091 .builtInPortNumbersDisabled) }}
          {{- end }}
          {{- end }}
          ports:
            - containerPort: 8181
              protocol: TCP
            - containerPort: 9090
              protocol: TCP
            - containerPort: 9091
              protocol: TCP
          livenessProbe:
            httpGet:
              path: "/health/liveness"
              port: 8181
          startupProbe:
            httpGet:
              path: "/health/liveness"
              port: 8181
            failureThreshold: 18
          resources:
            {{- toYaml .Values.core.resources | nindent 12 }}
        - name: {{ printf "%s-%s" .Chart.Name "db" }}
          securityContext:
            {{- toYaml (.Values.db).securityContext | nindent 12 }}
          image: "{{ (.Values.db).image.repository }}:{{ (.Values.db).image.tag }}"
          imagePullPolicy: {{ (.Values.db).image.pullPolicy }}
          env:
          - name: POSTGRESQL_USER
            value: cryostat3
          - name: POSTGRESQL_PASSWORD
            valueFrom:
              secretKeyRef:
                name: {{ printf "%s-db-connection-key" .Release.Name }}
                key: CONNECTION_KEY
                optional: false
          - name: POSTGRESQL_DATABASE
            value: cryostat3
          - name: PG_ENCRYPT_KEY
            valueFrom:
              secretKeyRef:
                name: {{ default (printf "%s-db-encryption-key" .Release.Name) .Values.core.databaseSecretName }}
                key: ENCRYPTION_KEY
                optional: false
          ports:
            - containerPort: 5432
              protocol: TCP
          volumeMounts:
          - mountPath: /var/lib/pgsql/data
            name: {{ .Chart.Name }}
            subPath: postgres
          readinessProbe:
            exec:
              command:
              - pg_isready
              - -U
              - cryostat3
              - -d
              - cryostat3
        - name: {{ printf "%s-%s" .Chart.Name "storage" }}
          securityContext:
            {{- toYaml (.Values.storage).securityContext | nindent 12 }}
          image: "{{ (.Values.storage).image.repository }}:{{ (.Values.storage).image.tag }}"
          imagePullPolicy: {{ (.Values.storage).image.pullPolicy }}
          env:
          - name: CRYOSTAT_BUCKETS
            value: archivedrecordings,archivedreports,eventtemplates,probes
          - name: CRYOSTAT_ACCESS_KEY
            value: cryostat
          - name: CRYOSTAT_SECRET_KEY
            valueFrom:
              secretKeyRef:
                name: {{ printf "%s-storage-secret-key" .Release.Name }}
                key: SECRET_KEY
                optional: false
          - name: DATA_DIR
            value: /data
          - name: IP_BIND
            value: 0.0.0.0
          ports:
            - containerPort: 8333
              protocol: TCP
          volumeMounts:
          - mountPath: /data
            name: {{ .Chart.Name }}
            subPath: seaweed
          livenessProbe:
            httpGet:
              path: "/status"
              port: 8333
            periodSeconds: 10
            failureThreshold: 2
          startupProbe:
            httpGet:
              path: "/status"
              port: 8333
            periodSeconds: 10
            failureThreshold: 9
          resources:
            {{- toYaml (.Values.storage).resources | nindent 12 }}
          securityContext:
            {{- toYaml (.Values.storage).securityContext | nindent 12 }}
        - name: {{ printf "%s-%s" .Chart.Name "grafana" }}
          securityContext:
            {{- toYaml .Values.grafana.securityContext | nindent 12 }}
          image: "{{ .Values.grafana.image.repository }}:{{ .Values.grafana.image.tag }}"
          imagePullPolicy: {{ .Values.grafana.image.pullPolicy }}
          env:
          - name: GF_AUTH_ANONYMOUS_ENABLED
            value: "true"
          - name: GF_SERVER_DOMAIN
            value: localhost
          - name: GF_SERVER_ROOT_URL
            value: http://localhost:4180/grafana/
          - name: GF_SERVER_SERVE_FROM_SUB_PATH
            value: "true"
          - name: JFR_DATASOURCE_URL
            value: http://localhost:8800
          ports:
          - containerPort: 3000
            protocol: TCP
          livenessProbe:
            httpGet:
              path: /api/health
              port: 3000
          resources:
            {{- toYaml .Values.grafana.resources | nindent 12 }}
        - name: {{ printf "%s-%s" .Chart.Name "jfr-datasource" }}
          securityContext:
            {{- toYaml .Values.datasource.securityContext | nindent 12 }}
          image: "{{ .Values.datasource.image.repository }}:{{ .Values.datasource.image.tag }}"
          imagePullPolicy: {{ .Values.datasource.image.pullPolicy }}
          env:
          - name: LISTEN_HOST
            value: localhost
          - name: QUARKUS_HTTP_PORT
            value: "8800"
          ports:
          - containerPort: 8800
            protocol: TCP
          livenessProbe:
            exec:
              command:
              - curl
              - --fail
              - http://localhost:8800
          resources:
            {{- toYaml .Values.datasource.resources | nindent 12 }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
      {{- if ((.Values.pvc).enabled) }}
      - name: {{ .Chart.Name }}
        persistentVolumeClaim:
          claimName: {{ .Release.Name }}
      {{- end }}
      {{- if not ((.Values.pvc).enabled) }}
      - name: {{ .Chart.Name }}
        emptyDir: {}
      {{- end }}
      - name: alpha-config
        configMap:
          name: {{ .Release.Name }}-alpha-config
      {{- if .Values.authentication.basicAuth.enabled }}
      - name: {{ .Release.Name }}-htpasswd
        secret:
          defaultMode: 0440
          secretName: {{ .Values.authentication.basicAuth.secretName }}
      {{- end }}
      {{- if (.Values.authentication.openshift).enabled }}
      - name: {{ .Release.Name }}-proxy-tls
        secret:
          secretName: {{ .Release.Name }}-proxy-tls
      {{- end }}