apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: rhm-data-service
spec:
  selector:
    matchLabels:
      app: rhm-data-service
  serviceName: rhm-data-service
  replicas: 3
  template:
    metadata:
      labels:
        app: rhm-data-service
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: app
                      operator: In
                      values:
                        - rhm-data-service
                namespaces:
                  - redhat-marketplace
                topologyKey: kubernetes.io/hostname
              weight: 100
      containers:
        - image: redhat-marketplace-authcheck
          imagePullPolicy: IfNotPresent
          name: authcheck
          resources:
            requests:
              cpu: 10m
              memory: 20Mi
          terminationMessagePolicy: FallbackToLogsOnError
        - command: ['/bin/sh']
          args:
            [
              '-c',
              'if [ "$POD_NAME" != "rhm-data-service-0" ]; then DQLITE_JOIN="--join rhm-data-service-0.rhm-data-service.$POD_NAMESPACE.svc.cluster.local:9001"; fi; exec /usr/local/bin/entrypoint --ca-cert /etc/tls/private/ca.crt --tls-cert /etc/tls/private/tls.crt --tls-key /etc/tls/private/tls.key --api 127.0.0.1:8003 --db $POD_NAME.rhm-data-service.$POD_NAMESPACE.svc.cluster.local:9001 --dir /data -v $DQLITE_JOIN',
            ]
          env:
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
          image: redhat-marketplace-data-service
          imagePullPolicy: IfNotPresent
          name: rhm-data-service
          ports:
            - containerPort: 9001
              name: db
          resources:
            requests:
              cpu: 100m
              memory: 25Mi
          volumeMounts:
            - name: rhm-data-service
              mountPath: /data
            - mountPath: /etc/tls/private
              name: rhm-data-service-mtls
              readOnly: false
        - args:
            - --logtostderr
            - --secure-listen-address=:8004
            - --insecure-listen-address=:8005
            - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
            - --upstream=http://127.0.0.1:8003/
            - --upstream-force-h2c
            - --v=10
            - --tls-cert-file=/etc/tls/private/tls.crt
            - --tls-private-key-file=/etc/tls/private/tls.key
            - --auth-token-audiences=rhm-data-service.{{NAMESPACE}}.svc
          image: registry.redhat.io/openshift4/ose-kube-rbac-proxy:latest
          imagePullPolicy: Always
          name: kube-rbac-proxy-1
          ports:
            - containerPort: 8004
              name: grpc
          resources:
            requests:
              cpu: 10m
              memory: 20Mi
          securityContext: {}
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
            - mountPath: /etc/tls/private
              name: rhm-data-service-tls
              readOnly: false
            - mountPath: /etc/configmaps/serving-cert-ca-bundle
              name: serving-certs-ca-bundle
              readOnly: false
            - mountPath: /etc/tls/mtls
              name: rhm-data-service-mtls
              readOnly: false
      volumes:
        - name: rhm-data-service-tls
          secret:
            secretName: rhm-data-service-tls
        - name: rhm-data-service-mtls
          secret:
            secretName: rhm-data-service-mtls
        - configMap:
            name: serving-certs-ca-bundle
          name: serving-certs-ca-bundle
      serviceAccountName: redhat-marketplace-operator
  volumeClaimTemplates:
    - metadata:
        name: rhm-data-service
      spec:
        accessModes: ['ReadWriteOnce']
        resources:
          requests:
            storage: 1Gi
