deployment-dataplane.yaml

#################################################################################
  #  Copyright (c) 2023 ZF Friedrichshafen AG
  #  Copyright (c) 2023 Mercedes-Benz Tech Innovation GmbH
  #  Copyright (c) 2023 Bayerische Motoren Werke Aktiengesellschaft (BMW AG)
  #  Copyright (c) 2021,2023 Contributors to the Eclipse Foundation
  #
  #  See the NOTICE file(s) distributed with this work for additional
  #  information regarding copyright ownership.
  #
  #  This program and the accompanying materials are made available under the
  #  terms of the Apache License, Version 2.0 which is available at
  #  https://www.apache.org/licenses/LICENSE-2.0.
  #
  #  Unless required by applicable law or agreed to in writing, software
  #  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  #  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  #  License for the specific language governing permissions and limitations
  #  under the License.
  #
  #  SPDX-License-Identifier: Apache-2.0
  #################################################################################


---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "txdc.fullname" . }}-dataplane
  labels:
    {{- include "txdc.dataplane.labels" . | nindent 4 }}
spec:
  {{- if not .Values.dataplane.autoscaling.enabled }}
  replicas: {{ .Values.dataplane.replicaCount }}
  {{- end }}
  selector:
    matchLabels:
      {{- include "txdc.dataplane.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      {{- with .Values.dataplane.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "txdc.dataplane.selectorLabels" . | nindent 8 }}
        {{- with .Values.dataplane.podLabels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "txdc.serviceAccountName" . }}
      securityContext:
        {{- toYaml .Values.dataplane.podSecurityContext | nindent 8 }}
      {{- if or .Values.dataplane.initContainers .Values.customCaCerts }}
      initContainers:
        {{- if .Values.dataplane.initContainers }}
        {{- toYaml .Values.dataplane.initContainers | nindent 8 }}
        {{- end }}
        {{- if .Values.customCaCerts }}
        - name: custom-cacerts
          # either use the specified image, or use the default one
          {{- if .Values.dataplane.image.repository }}
          image: "{{ .Values.dataplane.image.repository }}:{{ .Values.dataplane.image.tag | default .Chart.AppVersion }}"
          {{- else }}
          image: "tractusx/edc-dataplane-azure-vault:{{ .Values.dataplane.image.tag | default .Chart.AppVersion }}"
          {{- end }}
          imagePullPolicy: {{ .Values.dataplane.image.pullPolicy }}
          command:
            - /bin/sh
            - -c
            - |
              cp /opt/java/openjdk/lib/security/cacerts /workdir/
              find /cacerts -type f \( -iname \*.crt -o -iname \*.pem \) -exec echo "{}" \; | while read PEM_FILE_PATH; do
                PEM_FILE=${PEM_FILE_PATH##*/}
                ALIAS=${PEM_FILE%.*}
                echo "adding ${PEM_FILE} with alias ${ALIAS} to cacerts ..."
                keytool -import -noprompt -trustcacerts -alias ${ALIAS} -file ${PEM_FILE_PATH} -keystore /workdir/cacerts -storepass changeit
              done
          securityContext:
            {{- toYaml .Values.dataplane.securityContext | nindent 12 }}
          volumeMounts:
            - name: custom-cacertificates
              mountPath: /cacerts
            - name: custom-cacerts
              mountPath: /workdir
        {{- end }}
      {{- end }}
      containers:
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.dataplane.securityContext | nindent 12 }}
          {{- if .Values.dataplane.image.repository }}
          image: "{{ .Values.dataplane.image.repository }}:{{ .Values.dataplane.image.tag | default .Chart.AppVersion }}"
          {{- else }}
          image: "tractusx/edc-dataplane-azure-vault:{{ .Values.dataplane.image.tag | default .Chart.AppVersion }}"
          {{- end }}
          imagePullPolicy: {{ .Values.dataplane.image.pullPolicy }}
          ports:
          {{- range $key,$value := .Values.dataplane.endpoints }}
            - name: {{ $key }}
              containerPort: {{ $value.port }}
              protocol: TCP
          {{- end }}
          {{- if .Values.dataplane.livenessProbe.enabled }}
          livenessProbe:
            httpGet:
              path: {{ .Values.dataplane.endpoints.default.path }}/check/liveness
              port: {{ .Values.dataplane.endpoints.default.port }}
            initialDelaySeconds: {{ .Values.dataplane.livenessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.dataplane.livenessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.dataplane.livenessProbe.timeoutSeconds }}
            failureThreshold: {{ .Values.dataplane.livenessProbe.failureThreshold }}
            successThreshold: {{ .Values.dataplane.livenessProbe.successThreshold }}
          {{- end }}
          {{- if .Values.dataplane.readinessProbe.enabled }}
          readinessProbe:
            httpGet:
              path: {{ .Values.dataplane.endpoints.default.path }}/check/readiness
              port: {{ .Values.dataplane.endpoints.default.port }}
            initialDelaySeconds: {{ .Values.dataplane.readinessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.dataplane.readinessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.dataplane.readinessProbe.timeoutSeconds }}
            failureThreshold: {{ .Values.dataplane.readinessProbe.failureThreshold }}
            successThreshold: {{ .Values.dataplane.readinessProbe.successThreshold }}
          {{- end }}
          resources:
            {{- toYaml .Values.dataplane.resources | nindent 12 }}
          env:
          {{- if .Values.dataplane.debug.enabled }}
            - name: "JAVA_TOOL_OPTIONS"
            {{- if .Values.dataplane.debug.suspendOnStart }}
              value: >-
                {{ printf "-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=%v" .Values.dataplane.debug.port }}
            {{- else }}
              value: >-
                {{ printf "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=%v" .Values.dataplane.debug.port }}
            {{- end }}
          {{- end }}

            ########################
            ## ID CONFIGURATION ##
            ########################
            - name: EDC_PARTICIPANT_ID
              value: {{ .Values.participant.id | required ".Values.participant.id is required" | quote }}
            - name: "EDC_IAM_ISSUER_ID"
              value: {{ .Values.iatp.id | required ".Values.iatp.id is required" | quote}}

            #######
            # API #
            #######
            - name: "TX_EDC_DPF_CONSUMER_PROXY_AUTH_APIKEY"
              value: {{ .Values.dataplane.endpoints.proxy.authKey | required ".Values.dataplane.endpoints.proxy.authKey is required" | quote }}
            - name: "WEB_HTTP_DEFAULT_PORT"
              value: {{ .Values.dataplane.endpoints.default.port | quote }}
            - name: "WEB_HTTP_DEFAULT_PATH"
              value: {{ .Values.dataplane.endpoints.default.path | quote }}
            - name: "WEB_HTTP_CONTROL_PORT"
              value: {{ .Values.dataplane.endpoints.control.port | quote }}
            - name: "WEB_HTTP_CONTROL_PATH"
              value: {{ .Values.dataplane.endpoints.control.path | quote }}
            - name: "WEB_HTTP_PUBLIC_PORT"
              value: {{ .Values.dataplane.endpoints.public.port | quote }}
            - name: "WEB_HTTP_PUBLIC_PATH"
              value: {{ .Values.dataplane.endpoints.public.path | quote }}
            - name: "EDC_CONTROL_ENDPOINT"
              value: {{ include "txdc.dataplane.url.control" . }}
            - name: "EDC_DPF_SELECTOR_URL"
              value: {{ include "txdc.controlplane.url.control" . }}/v1/dataplanes

            #######
            # AWS #
            #######
            {{- if .Values.dataplane.aws.endpointOverride }}
            - name: "EDC_AWS_ENDPOINT_OVERRIDE"
              value: {{ .Values.dataplane.aws.endpointOverride | quote }}
            {{- end   }}
            {{- if .Values.dataplane.aws.secretAccessKey }}
            - name: "AWS_SECRET_ACCESS_KEY"
              value: {{ .Values.dataplane.aws.secretAccessKey | quote }}
            {{- end }}
            {{- if .Values.dataplane.aws.accessKeyId }}
            - name: "AWS_ACCESS_KEY_ID"
              value: {{ .Values.dataplane.aws.accessKeyId | quote }}
            {{- end }}

            ###########
            ## VAULT ##
            ###########

            - name: "EDC_VAULT_NAME"
              value: {{ .Values.vault.azure.name | required ".Values.vault.azure.name is required" | quote }}
            # only set the env vars if config value not null
            {{- if .Values.vault.azure.client }}
            - name: "AZURE_CLIENT_ID"
              value: {{ .Values.vault.azure.client | quote  }}
            {{- end }}
            {{- if .Values.vault.azure.tenant }}
            - name: "AZURE_TENANT_ID"
              value: {{ .Values.vault.azure.tenant | quote }}
            {{- end }}
            {{- if .Values.vault.azure.secret }}
            - name: "AZURE_CLIENT_SECRET"
              value: {{ .Values.vault.azure.secret | quote }}
            {{- end }}
            {{- if .Values.vault.azure.certificate }}
            - name: "AZURE_CLIENT_CERTIFICATE_PATH"
              value: {{ .Values.vault.azure.certificate | quote }}
            {{- end }}

            #############################
            ## IATP / STS / DIM CONFIG ##
            #############################
            - name: "EDC_IAM_STS_OAUTH_TOKEN_URL"
              value: {{ .Values.iatp.sts.oauth.token_url | required ".Values.iatp.sts.oauth.token_url is required" | quote}}
            - name: "EDC_IAM_STS_OAUTH_CLIENT_ID"
              value: {{ .Values.iatp.sts.oauth.client.id | required ".Values.iatp.sts.oauth.client.id is required" | quote}}
            - name: "EDC_IAM_STS_OAUTH_CLIENT_SECRET_ALIAS"
              value: {{ .Values.iatp.sts.oauth.client.secret_alias | required ".Values.iatp.sts.oauth.client.secret_alias is required" | quote}}
            - name: "TX_EDC_IAM_STS_DIM_URL"
              value: {{ .Values.iatp.sts.dim.url | required ".Values.iatp.sts.dim.url is required" | quote}}

            ################
            ## POSTGRESQL ##
            ################

            # see extension https://github.com/eclipse-edc/Connector/tree/main/extensions/common/store/sql/edr-index-sql
            - name: "EDC_DATASOURCE_EDR_NAME"
              value: "edr"
            - name: "EDC_DATASOURCE_EDR_USER"
              value: {{ .Values.postgresql.auth.username | required ".Values.postgresql.auth.username is required" | quote }}
            - name: "EDC_DATASOURCE_EDR_PASSWORD"
              value: {{ .Values.postgresql.auth.password | required ".Values.postgresql.auth.password is required" | quote }}
            - name: "EDC_DATASOURCE_EDR_URL"
              value: {{ tpl .Values.postgresql.jdbcUrl . | quote }}

            # see extension https://github.com/eclipse-edc/Connector/tree/main/extensions/data-plane/store/sql/data-plane-store-sql
            - name: "EDC_DATASOURCE_DATAPLANE_NAME"
              value: "edr"
            - name: "EDC_DATASOURCE_DATAPLANE_USER"
              value: {{ .Values.postgresql.auth.username | required ".Values.postgresql.auth.username is required" | quote }}
            - name: "EDC_DATASOURCE_DATAPLANE_PASSWORD"
              value: {{ .Values.postgresql.auth.password | required ".Values.postgresql.auth.password is required" | quote }}
            - name: "EDC_DATASOURCE_DATAPLANE_URL"
              value: {{ tpl .Values.postgresql.jdbcUrl . | quote }}

            # see extension https://github.com/eclipse-edc/Connector/tree/main/extensions/data-plane/store/sql/accesstokendata-store-sql
            - name: "EDC_DATASOURCE_ACCESSTOKENDATA_NAME"
              value: "edr"
            - name: "EDC_DATASOURCE_ACCESSTOKENDATA_USER"
              value: {{ .Values.postgresql.auth.username | required ".Values.postgresql.auth.username is required" | quote }}
            - name: "EDC_DATASOURCE_ACCESSTOKENDATA_PASSWORD"
              value: {{ .Values.postgresql.auth.password | required ".Values.postgresql.auth.password is required" | quote }}
            - name: "EDC_DATASOURCE_ACCESSTOKENDATA_URL"
              value: {{ tpl .Values.postgresql.jdbcUrl . | quote }}

            #########################
            ## DATA PLANE PUBLIC API
            ########################
            - name: "EDC_DATAPLANE_API_PUBLIC_BASEURL"
              value: {{ include "txdc.dataplane.url.public" . }}


            ##################
            ## TOKEN REFRESH
            ##################
            {{- if .Values.dataplane.token.refresh.expiry_seconds }}
            - name: "TX_EDC_DATAPLANE_TOKEN_EXPIRY"
              value: {{ .Values.dataplane.token.refresh.expiry_seconds | quote}}
            {{- end}}

            {{- if .Values.dataplane.token.refresh.expiry_tolerance_seconds }}
            - name: "TX_EDC_DATAPLANE_TOKEN_EXPIRY_TOLERANCE"
              value: {{ .Values.dataplane.token.refresh.expiry_tolerance_seconds | quote }}
            {{- end}}

            {{- if .Values.dataplane.token.refresh.refresh_endpoint }}
            - name: "TX_EDC_DATAPLANE_TOKEN_REFRESH_ENDPOINT"
              value: {{ .Values.dataplane.token.refresh.refresh_endpoint }}
            {{- else}}
            - name: "TX_EDC_DATAPLANE_TOKEN_REFRESH_ENDPOINT"
              value: {{ include "txdc.dataplane.url.public" . }}/token
            {{- end}}

            - name: "EDC_TRANSFER_PROXY_TOKEN_SIGNER_PRIVATEKEY_ALIAS"
              value: {{ .Values.dataplane.token.signer.privatekey_alias | required ".Values.dataplane.token.signer.privatekey_alias is required" | quote}}

            - name: "EDC_TRANSFER_PROXY_TOKEN_VERIFIER_PUBLICKEY_ALIAS"
              value: {{ .Values.dataplane.token.verifier.publickey_alias | required ".Values.dataplane.token.verifier.publickey_alias" | quote }}


            ######################################
            ## Additional environment variables ##
            ######################################
            - name: "EDC_RUNTIME_ID"
              value: {{ include "txdc.fullname" .}}-dataplane
          {{- range $key, $value := .Values.dataplane.envValueFrom }}
            - name: {{ $key | quote }}
              valueFrom:
                {{- tpl (toYaml $value) $ | nindent 16 }}
          {{- end }}
          {{- range $key, $value := .Values.dataplane.env }}
            - name: {{ $key | quote }}
              value: {{ $value | quote }}
          {{- end }}
          {{- if and (or .Values.dataplane.envSecretNames .Values.dataplane.envConfigMapNames) (or (gt (len .Values.dataplane.envSecretNames) 0) (gt (len .Values.dataplane.envConfigMapNames) 0)) }}
          envFrom:
          {{- range $value := .Values.dataplane.envSecretNames }}
            - secretRef:
                name: {{ $value | quote }}
          {{- end }}
          {{- range $value := .Values.dataplane.envConfigMapNames }}
            - configMapRef:
                name: {{ $value | quote }}
          {{- end }}
          {{- end }}
          volumeMounts:
           {{- if .Values.dataplane.volumeMounts }}
           {{- toYaml .Values.dataplane.volumeMounts | nindent 12 }}
           {{- end}}
            - name: "configuration"
              mountPath: "/app/opentelemetry.properties"
              subPath: "opentelemetry.properties"
            - name: "configuration"
              mountPath: "/app/logging.properties"
              subPath: "logging.properties"
            {{- if .Values.customCaCerts }}
            - name: custom-cacerts
              mountPath: /opt/java/openjdk/lib/security/cacerts
              subPath: cacerts
            {{- end }}
            - name: "tmp"
              mountPath: "/tmp"
      volumes:
       {{- if .Values.dataplane.volumes }}
       {{- toYaml .Values.dataplane.volumes | nindent 8 }}
       {{- end}}
        - name: "configuration"
          configMap:
            name: {{ include "txdc.fullname" . }}-dataplane
            items:
              - key: "opentelemetry.properties"
                path: "opentelemetry.properties"
              - key: "logging.properties"
                path: "logging.properties"
        {{- if .Values.customCaCerts }}
        - name: custom-cacertificates
          configMap:
            name: {{ include "txdc.fullname" . }}-custom-cacerts
            defaultMode: 0400
        - name: custom-cacerts
          emptyDir:
            sizeLimit: 1Mi
        {{- end }}
        - name: "tmp"
          emptyDir: { }
      {{- with .Values.dataplane.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.dataplane.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.dataplane.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}