{{/* # ============LICENSE_START======================================================= # Copyright (C) 2021-2025 Nordix Foundation. # Modification (C) 2025 Deutsche Telekom. All rights reserved. # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # # SPDX-License-Identifier: Apache-2.0 # ============LICENSE_END========================================================= */}} apiVersion: apps/v1 kind: Deployment metadata: {{- include "common.resourceMetadata" . | nindent 2 }} spec: selector: {{- include "common.selectors" . | nindent 4 }} replicas: {{ .Values.replicaCount }} template: metadata: {{- include "common.templateMetadata" . | nindent 6 }} spec: {{ include "common.podSecurityContext" . | indent 6 | trim }} {{- include "common.imagePullSecrets" . | nindent 6 }} initContainers: {{ include "common.readinessCheck.waitFor" . | indent 8 | trim }} - name: {{ include "common.name" . }}-pg-config image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.postgresImage }} imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} {{ include "common.containerSecurityContext" . | indent 10 | trim }} command: - /bin/sh - -cx - | /docker-entrypoint-initdb.d/db-pg.sh env: - name: PG_ADMIN_PASSWORD valueFrom: secretKeyRef: {{- if eq .Values.global.postgres.localCluster true }} name: '{{ include "common.release" . }}-policy-db-root-password' {{- else }} name: '{{ .Values.global.postgres.userRootSecret }}' {{- end }} key: password - name: PG_HOST value: "{{ .Values.global.postgres.service.name2 }}" - name: PG_USER {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "login") | indent 12 }} - name: PG_USER_PASSWORD {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "password") | indent 12 }} - name: PG_PORT value: "{{ .Values.global.postgres.service.port }}" resources: requests: cpu: 50m memory: 64Mi limits: cpu: 300m memory: 128Mi volumeMounts: - mountPath: /docker-entrypoint-initdb.d/db-pg.sh name: {{ include "common.fullname" . }}-config subPath: db-pg.sh - name: {{ include "common.name" . }}-pg-db-migrator image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.dbmigrator.image }} imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} {{ include "common.containerSecurityContext" . | indent 10 | trim }} volumeMounts: - mountPath: /dbcmd-config/db_migrator_pg_policy_init.sh name: {{ include "common.fullname" . }}-config subPath: db_migrator_pg_policy_init.sh - mountPath: /opt/app/policy/etc/db/ name: {{ include "common.fullname" . }}-migration-writable command: - /bin/sh - -cx - | /dbcmd-config/db_migrator_pg_policy_init.sh env: - name: SQL_HOST value: "{{ .Values.global.postgres.service.name2 }}" - name: SQL_USER {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "login") | indent 12 }} - name: SQL_PASSWORD {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "password") | indent 12 }} - name: SQL_DB value: {{ .Values.dbmigrator.schemas }} - name: POLICY_HOME value: {{ .Values.dbmigrator.policy_home }} - name: SCRIPT_DIRECTORY value: "postgres" - name: PGPASSWORD {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "password") | indent 12 }} resources: {{ include "common.resources" . | nindent 12 }} - command: - sh args: - -c - "cd /config-input && for PFILE in `ls -1`; do envsubst <${PFILE} >/config/${PFILE}; done" env: - name: SQL_USER {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "login") | indent 12 }} - name: SQL_PASSWORD {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "password") | indent 12 }} - name: RESTSERVER_USER {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "restserver-creds" "key" "login") | indent 12 }} - name: RESTSERVER_PASSWORD {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "restserver-creds" "key" "password") | indent 12 }} volumeMounts: - mountPath: /config-input name: apiconfig - mountPath: /config name: apiconfig-processed name: {{ include "common.name" . }}-update-config image: {{ include "repositoryGenerator.image.envsubst" . }} imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} resources: requests: cpu: 10m memory: 64Mi limits: cpu: 100m memory: 128Mi {{ include "common.containerSecurityContext" . | indent 10 | trim }} containers: - name: {{ include "common.name" . }} {{ include "common.containerSecurityContext" . | indent 10 | trim }} image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.image }} imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} command: ["/opt/app/policy/api/bin/policy-api.sh"] args: ["/opt/app/policy/api/etc/mounted/apiParameters.yaml"] ports: {{ include "common.containerPorts" . | nindent 12 }} # disable liveness probe when breakpoints set in debugger # so K8s doesn't restart unresponsive container {{- if eq .Values.liveness.enabled true }} livenessProbe: tcpSocket: port: {{ .Values.service.internalPort }} initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }} periodSeconds: {{ .Values.liveness.periodSeconds }} {{- end }} readinessProbe: httpGet: path: {{ .Values.readiness.api }} port: {{ .Values.service.internalPort }} httpHeaders: - name: Authorization value: Basic {{ printf "%s:%s" .Values.restServer.user .Values.restServer.password | b64enc }} scheme: HTTP successThreshold: {{ .Values.readiness.successThreshold }} failureThreshold: {{ .Values.readiness.failureThreshold }} initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }} periodSeconds: {{ .Values.readiness.periodSeconds }} timeoutSeconds: {{ .Values.readiness.timeout }} volumeMounts: - name: logs mountPath: /var/log/onap - name: empty-dir mountPath: /tmp subPath: tmp-dir - mountPath: /opt/app/policy/api/etc/logback.xml subPath: logback.xml name: apiconfig-processed - mountPath: /opt/app/policy/api/etc/mounted name: apiconfig-processed resources: {{ include "common.resources" . | nindent 12 }} {{- if .Values.nodeSelector }} nodeSelector: {{ toYaml .Values.nodeSelector | indent 10 }} {{- end -}} {{- if .Values.affinity }} affinity: {{ toYaml .Values.affinity | indent 10 }} {{- end }} serviceAccountName: {{ include "common.fullname" (dict "suffix" "read" "dot" . )}} volumes: - name: apiconfig configMap: name: {{ include "common.fullname" . }}-configmap defaultMode: 0755 - name: apiconfig-processed emptyDir: medium: Memory sizeLimit: 64Mi - name: empty-dir emptyDir: sizeLimit: {{ .Values.dirSizes.emptyDir.sizeLimit }} - name: logs emptyDir: sizeLimit: {{ .Values.dirSizes.logDir.sizeLimit }} - name: {{ include "common.fullname" . }}-migration-writable emptyDir: sizeLimit: {{ .Values.dirSizes.migration.sizeLimit }} - name: {{ include "common.fullname" . }}-config configMap: name: {{ include "common.fullname" . }}-db-configmap defaultMode: 0755 items: - key: db-pg.sh path: db-pg.sh - key: db_migrator_pg_policy_init.sh path: db_migrator_pg_policy_init.sh