template.yml

kind: Template
apiVersion: template.openshift.io/v1
parameters:
  - name: BRANCH
    required: true
  - name: APP
    required: true
    value: finbif2gbif
  - name: PAGE_TITLE
    required: true
    value: "FinBIF to GBIF"
  - name: APP_PORT
    required: true
    value: "8000"
  - name: STORAGE_CLASS
    required: true
    value: standard-csi
  - name: ACCESS_MODE
    required: true
    value: ReadWriteOnce
  - name: HEALTH
    required: true
    value: /healthz
  - name: LIVENESS_PERIOD
    required: true
    value: "30"
  - name: FAILURE_THRESHOLD
    required: true
    value: "5"
  - name: READINESS_PERIOD
    required: true
    value: "5"
  - name: HOST
    required: true
  - name: FINBIF_API
    required: true
  - name: FINBIF_ACCESS_TOKEN
    required: true
  - name: GBIF_USER
    required: true
  - name: GBIF_ORG
    required: true
  - name: GBIF_INSTALLATION
    required: true
  - name: GBIF_PASS
    required: true
  - name: GBIF_API
    required: true
  - name: SMTP_SERVER
    required: true
  - name: SMTP_PORT
    required: true
  - name: ERROR_EMAIL_TO
    required: true
  - name: ERROR_EMAIL_FROM
    required: true
  - name: STORAGE
    required: true
  - name: JOB_SECRET
    required: true
  - name: RCLONE_ACCESS_KEY_ID
    required: true
  - name: RCLONE_SECRET_ACCESS_KEY
    required: true
metadata:
  name: ${APP}
objects:
- kind: PersistentVolumeClaim
  apiVersion: v1
  metadata:
    name: ${APP}-${BRANCH}
  spec:
    storageClassName: ${STORAGE_CLASS}
    accessModes:
    - ${ACCESS_MODE}
    resources:
      requests:
        storage: ${STORAGE}
- kind: Secret
  apiVersion: v1
  metadata:
    name: ${APP}-${BRANCH}
  type: Opaque
  data:
    finbif_api: ${FINBIF_API}
    finbif_access_token: ${FINBIF_ACCESS_TOKEN}
    gbif_api: ${GBIF_API}
    gbif_user: ${GBIF_USER}
    gbif_org: ${GBIF_ORG}
    gbif_installation: ${GBIF_INSTALLATION}
    gbif_pass: ${GBIF_PASS}
    job_secret: ${JOB_SECRET}
    rclone_access_key_id: ${RCLONE_ACCESS_KEY_ID}
    rclone_secret_access_key: ${RCLONE_SECRET_ACCESS_KEY}
- kind: Deployment
  apiVersion: apps/v1
  metadata:
    name: ${APP}-${BRANCH}
    labels:
      app: ${APP}
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: ${APP}
    strategy:
      type: Recreate
    template:
      metadata:
        labels:
          app: ${APP}
          branch: ${BRANCH}
      spec:
        containers:
        - image: ghcr.io/luomus/${APP}:${BRANCH}
          imagePullPolicy: Always
          name: ${APP}-${BRANCH}
          ports:
          - containerPort: ${{APP_PORT}}
          volumeMounts:
          - mountPath: /home/user/var
            name: ${APP}-${BRANCH}
          startupProbe:
            httpGet:
              path: ${HEALTH}
              port: ${{APP_PORT}}
            failureThreshold: ${{FAILURE_THRESHOLD}}
            periodSeconds: ${{LIVENESS_PERIOD}}
          livenessProbe:
            httpGet:
              path: ${HEALTH}
              port: ${{APP_PORT}}
            failureThreshold: ${{FAILURE_THRESHOLD}}
            periodSeconds: ${{LIVENESS_PERIOD}}
          readinessProbe:
            httpGet:
              path: ${HEALTH}
              port: ${{APP_PORT}}
            periodSeconds: ${{READINESS_PERIOD}}
          env:
          - name: PAGE_TITLE
            value: ${PAGE_TITLE}
          - name: ENDPOINTS
            value: https://${HOST}
          - name: FINBIF_USER_AGENT
            value: https://github.com/luomus/${APP}.git
          - name: STATUS_DIR
            value: var/status
          - name: LOG_DIR
            value: var/logs
          - name: FINBIF_ACCESS_TOKEN
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: finbif_access_token
          - name: FINBIF_API
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: finbif_api
          - name: GBIF_USER
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: gbif_user
          - name: GBIF_ORG
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: gbif_org
          - name: GBIF_INSTALLATION
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: gbif_installation
          - name: GBIF_PASS
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: gbif_pass
          - name: GBIF_API
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: gbif_api
          - name: JOB_SECRET
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: job_secret
          - name: RCLONE_CONFIG_DEFAULT_ACCESS_KEY_ID
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: rclone_access_key_id
          - name: RCLONE_CONFIG_DEFAULT_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: rclone_secret_access_key
          - name: BRANCH
            value: ${BRANCH}
          - name: SMTP_SERVER
            value: ${SMTP_SERVER}
          - name: SMTP_PORT
            value: ${SMTP_PORT}
          - name: ERROR_EMAIL_TO
            value: ${ERROR_EMAIL_TO}
          - name: ERROR_EMAIL_FROM
            value: ${ERROR_EMAIL_FROM}
          resources:
            limits:
              cpu: "1000m"
              memory: "5Gi"
        volumes:
        - name: ${APP}-${BRANCH}
          persistentVolumeClaim:
            claimName: ${APP}-${BRANCH}
- kind: Service
  apiVersion: v1
  metadata:
    name: ${APP}-${BRANCH}
    labels:
      app: ${APP}
  spec:
    ports:
    - name: ${APP_PORT}
      port: ${{APP_PORT}}
      targetPort: ${{APP_PORT}}
    selector:
      app: ${APP}
      branch: ${BRANCH}
- kind: Route
  apiVersion: v1
  metadata:
    name: ${APP}-${BRANCH}
    labels:
      app: ${APP}
  spec:
    host: ${HOST}
    port:
      targetPort: ${{APP_PORT}}
    tls:
      insecureEdgeTerminationPolicy: Redirect
    to:
      kind: Service
      name: ${APP}-${BRANCH}
    wildcardPolicy: None
- kind: CronJob
  apiVersion: batch/v1
  metadata:
    name: ${APP}-${BRANCH}
  spec:
    schedule:  "0 20 * * *"
    concurrencyPolicy: "Forbid"
    successfulJobsHistoryLimit: 1
    failedJobsHistoryLimit: 3
    jobTemplate:
      spec:
        template:
          metadata:
            labels:
              app: ${APP}
          spec:
            containers:
            - name: ${APP}-${BRANCH}
              # docker manifest inspect docker.io/redhat/ubi9:9.4 -v | jq '.[0].Descriptor.digest'
              image: docker.io/redhat/ubi9:9.4@sha256:b8a991d0c5d0184d76196caf11ddc0605714c65f7a06ad23ad72e3d0a723eee1
              command:
                - 'sh'
                - '-c'
                - >-
                  curl -s -w '%{stderr} Code: %{response_code} URL: %{url_effective}\n'
                  $APP_HOSTNAME:$APP_PORT/job?secret=$JOB_SECRET
              env:
              - name: JOB_SECRET
                valueFrom:
                  secretKeyRef:
                    name: ${APP}-${BRANCH}
                    key: job_secret
              - name: APP_HOSTNAME
                value: ${APP}-${BRANCH}
              - name: APP_PORT
                value: ${APP_PORT}
              resources:
                limits:
                  cpu: "100m"
                  memory: "100Mi"
            restartPolicy: Never