kubernetes/aai/components/aai-graphadmin/templates/deployment.yaml

   1 {{/*
   2 #
   3 # ============LICENSE_START=======================================================
   4 # org.onap.aai
   5 # ================================================================================
   6 # Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   7 # Copyright (c) 2020 Nokia Intellectual Property. All rights reserved.
   8 # Copyright (c) 2020-2021 Orange Intellectual Property. All rights reserved.
   9 # ================================================================================
  10 # Licensed under the Apache License, Version 2.0 (the "License");
  11 # you may not use this file except in compliance with the License.
  12 # You may obtain a copy of the License at
  13 #
  14 #    http://www.apache.org/licenses/LICENSE-2.0
  15 #
  16 # Unless required by applicable law or agreed to in writing, software
  17 # distributed under the License is distributed on an "AS IS" BASIS,
  18 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  19 # See the License for the specific language governing permissions and
  20 # limitations under the License.
  21 # ============LICENSE_END=========================================================
  22 */}}
  23 apiVersion: apps/v1
  24 kind: Deployment
  25 metadata:
  26   name: {{ include "common.fullname" . }}
  27   namespace: {{ include "common.namespace" . }}
  28   labels:
  29     app: {{ include "common.name" . }}
  30     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
  31     release: {{ include "common.release" . }}
  32     heritage: {{ .Release.Service }}
  33 spec:
  34   replicas: {{ .Values.replicaCount }}
  35   minReadySeconds: {{ .Values.minReadySeconds }}
  36   strategy:
  37     type: {{ .Values.updateStrategy.type }}
  38     rollingUpdate:
  39       maxUnavailable: {{ .Values.updateStrategy.maxUnavailable }}
  40       maxSurge: {{ .Values.updateStrategy.maxSurge }}
  41   selector:
  42     matchLabels:
  43       app: {{ include "common.name" . }}
  44   template:
  45     metadata:
  46       labels:
  47         app: {{ include "common.name" . }}
  48         release: {{ include "common.release" . }}
  49       name: {{ include "common.name" . }}
  50       annotations:
  51         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
  52     spec:
  53       hostname: aai-graphadmin
  54       terminationGracePeriodSeconds: {{ .Values.service.terminationGracePeriodSeconds }}
  55     {{ if .Values.global.initContainers.enabled }}
  56       initContainers: {{ include "common.certInitializer.initContainer" . | nindent 6 }}
  57       {{- if .Values.global.aafEnabled }}
  58       - command:
  59         - sh
  60         args:
  61         - -c
  62         - |
  63           echo "*** retrieve Truststore and Keystore password"
  64           export $(cat {{ .Values.certInitializer.appMountPath }}/local/mycreds.prop | xargs -0)
  65           echo "*** obfuscate them "
  66           export KEYSTORE_PASSWORD=`java -cp /usr/local/jetty/lib/jetty-util-9.4.44.v20210927.jar org.eclipse.jetty.util.security.Password ${KEYSTORE_PLAIN_PASSWORD} 2>&1 | grep "OBF:"`
  67           export KEYSTORE_JKS_PASSWORD=`java -cp /usr/local/jetty/lib/jetty-util-9.4.44.v20210927.jar org.eclipse.jetty.util.security.Password ${KEYSTORE_JKS_PLAIN_PASSWORD} 2>&1 | grep "OBF:"`
  68           export TRUSTSTORE_PASSWORD=`java -cp /usr/local/jetty/lib/jetty-util-9.4.44.v20210927.jar org.eclipse.jetty.util.security.Password ${TRUSTSTORE_PLAIN_PASSWORD} 2>&1 | grep "OBF:"`
  69           echo "KEYSTORE_PASSWORD=${KEYSTORE_PASSWORD}" >> {{ .Values.certInitializer.appMountPath }}/local/mycreds.prop
  70           echo "KEYSTORE_JKS_PASSWORD=${KEYSTORE_JKS_PASSWORD}" >> {{ .Values.certInitializer.appMountPath }}/local/mycreds.prop
  71           echo "TRUSTSTORE_PASSWORD=${TRUSTSTORE_PASSWORD}" >> {{ .Values.certInitializer.appMountPath }}/local/mycreds.prop
  72         image: {{ include "repositoryGenerator.image.jetty" . }}
  73         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
  74         name: {{ include "common.name" . }}-obfuscate
  75         volumeMounts: {{ include "common.certInitializer.volumeMount" . | nindent 8 }}
  76         securityContext:
  77           runAsUser: {{ .Values.securityContext.user_id }}
  78       - command:
  79         - sh
  80         args:
  81         - -c
  82         - |
  83           echo "*** Set obfuscated Truststore and Keystore password into configuration file"
  84           export $(cat {{ .Values.certInitializer.appMountPath }}/local/mycreds.prop | xargs -0)
  85           cd /config-input
  86           for PFILE in `ls -1`
  87           do
  88             envsubst <${PFILE} >/config/${PFILE}
  89           done
  90         volumeMounts: {{ include "common.certInitializer.volumeMount" . | nindent 8 }}
  91         - mountPath: /config-input
  92           name: properties-input
  93         - mountPath: /config
  94           name: properties
  95         image: {{ include "repositoryGenerator.image.envsubst" . }}
  96         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
  97         name: {{ include "common.name" . }}-update-config
  98       {{- end }}
  99       - command:
 100       {{ if .Values.global.jobs.migration.enabled }}
 101         - /app/ready.py
 102         args:
 103         - --job-name
 104         - {{ include "common.release" . }}-aai-graphadmin-migration
 105       {{  else if .Values.global.jobs.createSchema.enabled  }}
 106         - /app/ready.py
 107         args:
 108         - --job-name
 109         - {{ include "common.release" . }}-aai-graphadmin-create-db-schema
 110       {{  else }}
 111         - /app/ready.py
 112         args:
 113         - --container-name
 114         {{- if .Values.global.cassandra.localCluster }}
 115         - aai-cassandra
 116         {{- else }}
 117         - cassandra
 118         {{- end }}
 119         - --container-name
 120         - aai-schema-service
 121       {{  end  }}
 122         env:
 123         - name: NAMESPACE
 124           valueFrom:
 125             fieldRef:
 126               apiVersion: v1
 127               fieldPath: metadata.namespace
 128         image: {{ include "repositoryGenerator.image.readiness" . }}
 129         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
 130         name: {{ include "common.name" . }}-readiness
 131       {{  end  }}
 132       containers:
 133       - name: {{ include "common.name" . }}
 134         image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.image }}
 135         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
 136         env:
 137         - name: LOCAL_USER_ID
 138           value: {{ .Values.securityContext.user_id | quote }}
 139         - name: LOCAL_GROUP_ID
 140           value: {{ .Values.securityContext.group_id | quote }}
 141         - name: INTERNAL_PORT_1
 142           value: {{ .Values.service.internalPort | quote }}
 143         - name: INTERNAL_PORT_2
 144           value: {{ .Values.service.internalPort2 | quote }}
 145         volumeMounts: {{ include "common.certInitializer.volumeMount" . | nindent 8 }}
 146         - mountPath: /etc/localtime
 147           name: localtime
 148           readOnly: true
 149         - mountPath: /opt/app/aai-graphadmin/resources/etc/appprops/janusgraph-realtime.properties
 150           name: config
 151           subPath: janusgraph-realtime.properties
 152         - mountPath: /opt/app/aai-graphadmin/resources/etc/appprops/janusgraph-cached.properties
 153           name: config
 154           subPath: janusgraph-cached.properties
 155         - mountPath: /opt/app/aai-graphadmin/resources/etc/appprops/aaiconfig.properties
 156           name: properties
 157           subPath: aaiconfig.properties
 158         - mountPath: /opt/aai/logroot/AAI-RES
 159           name: logs
 160         - mountPath: /opt/app/aai-graphadmin/resources/logback.xml
 161           name: config
 162           subPath: logback.xml
 163         - mountPath: /opt/app/aai-graphadmin/resources/localhost-access-logback.xml
 164           name: config
 165           subPath: localhost-access-logback.xml
 166         - mountPath: /opt/app/aai-graphadmin/resources/etc/auth/realm.properties
 167           name: config
 168           subPath: realm.properties
 169         - mountPath: /opt/app/aai-graphadmin/resources/application.properties
 170           name: properties
 171           subPath: application.properties
 172         ports:
 173         - containerPort: {{ .Values.service.internalPort }}
 174         - containerPort: {{ .Values.service.internalPort2 }}
 175         lifecycle:
 176           # wait for active requests (long-running tasks) to be finished
 177           # Before the SIGTERM is invoked, Kubernetes exposes a preStop hook in the Pod.
 178           preStop:
 179             exec:
 180               command:
 181                 - sh
 182                 - -c
 183                 - |
 184                   while (netstat -an | grep ESTABLISHED | grep -e $INTERNAL_PORT_1 -e $INTERNAL_PORT_2)
 185                   do sleep 10
 186                   done
 187         # disable liveness probe when breakpoints set in debugger
 188         # so K8s doesn't restart unresponsive container
 189         {{ if .Values.liveness.enabled }}
 190         livenessProbe:
 191           tcpSocket:
 192             port: {{ .Values.service.internalPort }}
 193           initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
 194           periodSeconds: {{ .Values.liveness.periodSeconds }}
 195         {{ end }}
 196         readinessProbe:
 197           tcpSocket:
 198             port: {{ .Values.service.internalPort }}
 199           initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
 200           periodSeconds: {{ .Values.readiness.periodSeconds }}
 201         resources:
 202 {{ include "common.resources" . }}
 203       {{- if .Values.nodeSelector }}
 204       nodeSelector:
 205 {{ toYaml .Values.nodeSelector | indent 8 }}
 206       {{- end -}}
 207       {{- if .Values.affinity }}
 208       affinity:
 209 {{ toYaml .Values.affinity | indent 8 }}
 210       {{- end }}
 211
 212       # side car containers
 213       {{ include "common.log.sidecar" . | nindent 6 }}
 214       serviceAccountName: {{ include "common.fullname" (dict "suffix" "read" "dot" . )}}
 215       volumes: {{ include "common.certInitializer.volumes" . | nindent 6 }}
 216       - name: localtime
 217         hostPath:
 218           path: /etc/localtime
 219       - name: logs
 220         emptyDir: {}
 221       {{ include "common.log.volumes" (dict "dot" . "configMapNamePrefix" (tpl .Values.logConfigMapNamePrefix .)) | nindent 6 }}
 222       - name: config
 223         configMap:
 224           name: {{ include "common.fullname" . }}
 225       - name: properties
 226       {{- if .Values.global.aafEnabled }}
 227         emptyDir:
 228           medium: Memory
 229       - name: properties-input
 230       {{- end }}
 231         configMap:
 232           name: {{ include "common.fullname" . }}-properties
 233       restartPolicy: {{ .Values.restartPolicy }}
 234       imagePullSecrets:
 235       - name: {{ include "common.namespace" . }}-docker-registry-key