Merge "[STRIMZI] Solve Security Policy violations"

[oom.git] / kubernetes / aai / components / aai-resources / templates / deployment.yaml

diff --git a/kubernetes/aai/components/aai-resources/templates/deployment.yaml b/kubernetes/aai/components/aai-resources/templates/deployment.yaml
index 54097fa..f00cb99 100644 (file)
--- a/kubernetes/aai/components/aai-resources/templates/deployment.yaml
+++ b/kubernetes/aai/components/aai-resources/templates/deployment.yaml
@@ -36,6 +36,7 @@ metadata:
     heritage: {{ .Release.Service }}
 spec:
   replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
   minReadySeconds: {{ .Values.minReadySeconds }}
   strategy:
     type: {{ .Values.updateStrategy.type }}
@@ -105,13 +106,9 @@ spec:
         - --job-name
         - {{ include "common.release" . }}-aai-graphadmin-create-db-schema
           {{- else }}
-        - --app-name
-            {{- if .Values.global.cassandra.localCluster }}
-        - aai-cassandra
-            {{- else }}
-        - cassandra
-            {{- end }}
-        - --container-name
+        - --service-name
+        - {{ .Values.global.cassandra.serviceName }}
+        - --service-name
         - aai-schema-service
           {{- end }}
         {{- end }}
@@ -123,17 +120,17 @@ spec:
               fieldPath: metadata.namespace
         image: {{ include "repositoryGenerator.image.readiness" . }}
         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+        resources:
+          limits:
+            cpu: "100m"
+            memory: "500Mi"
+          requests:
+            cpu: "3m"
+            memory: "20Mi"
       containers:
       - name: {{ include "common.name" . }}
         image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.image }}
         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
-        command:
-        - sh
-        args:
-        - -c
-        - |
-          echo "*** actual launch of AAI Resources"
-          /bin/bash /opt/app/aai-resources/docker-entrypoint.sh
         env:
         {{- if .Values.config.env }}
         {{- range $key,$value := .Values.config.env }}
@@ -154,15 +151,19 @@ spec:
         - name: LOCAL_GROUP_ID
           value: {{ .Values.global.config.groupId | quote }}
         - name: INTERNAL_PORT_1
-          value: {{ .Values.service.internalPort | quote }}
+          value: {{ .Values.service.resourcesPort | quote }}
         - name: INTERNAL_PORT_2
-          value: {{ .Values.service.internalPort2 | quote }}
+          value: {{ .Values.service.debugPort | quote }}
         - name: INTERNAL_PORT_3
-          value: {{ .Values.service.internalPort3 | quote }}
+          value: {{ .Values.service.metricsPort | quote }}
+        - name: BOOTSTRAP_SERVERS
+          value: {{ include "common.release" . }}-strimzi-kafka-bootstrap:9092
+        - name: JAAS_CONFIG
+          valueFrom:
+            secretKeyRef:
+              name: {{ include "common.release" . }}-{{ .Values.global.aaiKafkaUser }}
+              key: sasl.jaas.config
         volumeMounts:
-        - mountPath: /etc/localtime
-          name: localtime
-          readOnly: true
         - mountPath: /opt/app/aai-resources/resources/etc/appprops/janusgraph-realtime.properties
           name: {{ include "common.fullname" . }}-config
           subPath: janusgraph-realtime.properties
@@ -190,19 +191,18 @@ spec:
           name: {{ include "common.fullname" . }}-config
           subPath: application-keycloak.properties
         ports:
-        - containerPort: {{ .Values.service.internalPort }}
-          name: {{ .Values.service.portName }}
+        - containerPort: {{ .Values.service.resourcesPort }}
+          name: {{ .Values.service.resourcesPortName }}
         {{- if .Values.config.debug.enabled }}
-        - containerPort: {{ .Values.service.internalPort2 }}
-          name: {{ .Values.service.portName2 }}
+        - containerPort: {{ .Values.service.debugPort }}
+          name: {{ .Values.service.debugPortName }}
         {{- end }}
-        - containerPort: {{ .Values.service.internalPort3 }}
-          name: {{ .Values.service.portName3 }}
+        - containerPort: {{ .Values.service.metricsPort }}
+          name: {{ .Values.service.metricsPortName }}
         {{- if .Values.config.profiling.enabled }}
-        - containerPort: {{ .Values.service.internalPort4 }}
-          name: {{ .Values.service.portName4 }}
+        - containerPort: {{ .Values.service.profilingPort }}
+          name: {{ .Values.service.profilingPortName }}
         {{- end }}
-
         lifecycle:
           # wait for active requests (long-running tasks) to be finished
           # Before the SIGTERM is invoked, Kubernetes exposes a preStop hook in the Pod.
@@ -212,16 +212,16 @@ spec:
                 - sh
                 - -c
                 - |
-                  while (netstat -an | grep ESTABLISHED | grep -e $INTERNAL_PORT_1 -e $INTERNAL_PORT_2)
-                  do sleep 10
+                  while (netstat -an | grep ESTABLISHED | grep -e $INTERNAL_PORT_1)
+                  do sleep 3
                   done
-        # disable liveness probe when breakpoints set in debugger
-        # so K8s doesn't restart unresponsive container
-        {{- if .Values.liveness.enabled }}
+        # disable liveness probe when
+        # debugging.enable=true or profiling.enabled=true
+        {{- if and .Values.liveness.enabled (not (or .Values.config.debug.enabled .Values.config.profiling.enabled)) }}
         livenessProbe:
           httpGet:
             path: /aai/util/echo?action=checkDB
-            port: {{ .Values.service.internalPort }}
+            port: {{ .Values.service.resourcesPort }}
             scheme: HTTP
             httpHeaders:
             - name: X-FromAppId
@@ -236,7 +236,7 @@ spec:
         readinessProbe:
           httpGet:
             path: /aai/util/echo?action=checkDB
-            port: {{ .Values.service.internalPort }}
+            port: {{ .Values.service.resourcesPort }}
             scheme: HTTP
             httpHeaders:
             - name: X-FromAppId
@@ -258,9 +258,6 @@ spec:
       {{ include "common.log.sidecar" . | nindent 6 }}
       serviceAccountName: {{ include "common.fullname" (dict "suffix" "read" "dot" . )}}
       volumes:
-      - name: localtime
-        hostPath:
-          path: /etc/localtime
       - name: logs
         emptyDir: {}
       {{ include "common.log.volumes" (dict "dot" . "configMapNamePrefix" (tpl .Values.logConfigMapNamePrefix .)) | nindent 6 }}
@@ -268,5 +265,4 @@ spec:
         configMap:
           name: {{ include "common.fullname" . }}
       restartPolicy: {{ .Values.restartPolicy }}
-      imagePullSecrets:
-      - name: "{{ include "common.namespace" . }}-docker-registry-key"
+      {{- include "common.imagePullSecrets" . | nindent 6 }}