---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: logstash
  namespace: monitoring
  labels:
    app: "logstash"
spec:
  serviceName: logstash-headless
  selector:
    matchLabels:
      app: "logstash"
  replicas: 1
  podManagementPolicy: Parallel
  updateStrategy:
    type: RollingUpdate
  volumeClaimTemplates:
  - metadata:
      name: logstash
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 1Gi
  template:
    metadata:
      name: "logstash"
      labels:
        app: "logstash"
      annotations:
        telegraf.influxdata.com/inputs: |+
          [[inputs.logstash]]
            url = "http://localhost:9600"
        telegraf.influxdata.com/class: questdb 
        telegraf.influxdata.com/env-fieldref-NAMESPACE: metadata.namespace
        telegraf.influxdata.com/limits-cpu: '750m'
        # invalid memory limit, which will be ignored
        telegraf.influxdata.com/limits-memory: '800x'
        #telegraf.influxdata.com/image: 'osokaru/telegraf-timescaledb:4552a531'
    spec:
      securityContext:
        fsGroup: 1000
        runAsGroup: 1000
        runAsUser: 1000
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - "logstash"
            topologyKey: kubernetes.io/hostname
      terminationGracePeriodSeconds: 120
      volumes:
        - name: logstash-config-volume
          configMap:
            defaultMode: 256
            name: logstash-config
        - name: logstash-pipeline-volume
          configMap:
            defaultMode: 256
            name: logstash-pipeline
        - name: logstash-redis-certs
          secret:
            secretName: logstash-redis-certs
            defaultMode: 256
        - name: elastic-certificate-crt-volume
          secret:
            secretName: elastic-certificate-crt
      containers:
      - name: "logstash"
        securityContext:
          privileged: true
          capabilities:
            drop:
            - ALL
          runAsNonRoot: true
          runAsUser: 1000
        image: "docker.elastic.co/logstash/logstash:7.15.1"
        imagePullPolicy: "IfNotPresent"
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /
            port: http
          initialDelaySeconds: 300
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /
            port: http
          initialDelaySeconds: 60
          periodSeconds: 10
          successThreshold: 3
          timeoutSeconds: 5
        ports:
        - name: http
          containerPort: 9600
        resources:
          limits:
            cpu: 1000m
            memory: 1Gi
          requests:
            cpu: 100m
            memory: 512Mi
        env:
          - name: ELASTICSEARCH_USERNAME
            valueFrom:
              secretKeyRef:
                key: username
                name: es-master-credentials
          - name: ELASTICSEARCH_PASSWORD
            valueFrom:
              secretKeyRef:
                key: password
                name: es-master-credentials
        volumeMounts:
          - name: logstash
            mountPath: "/usr/share/logstash/data"
          - name: logstash-config-volume
            mountPath: "/usr/share/logstash/config/logstash.yml"
            subPath: "logstash.yml"
          - name: logstash-config-volume
            mountPath: "/usr/share/logstash/config/jvm.options"
            subPath: "jvm.options"
          - name: logstash-config-volume
            mountPath: "/usr/share/logstash/config/pipelines.yml"
            subPath: "pipelines.yml"
          - name: logstash-pipeline-volume
            mountPath: "/usr/share/logstash/pipeline"
          - name: logstash-redis-certs
            mountPath: "/usr/share/logstash/ssl"
          - name: elastic-certificate-crt-volume
            mountPath: /usr/share/logstash/config/certs

