---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: grafana
  namespace: monitoring
  labels:
    app: grafana
spec:
  replicas: 1
  selector:
    matchLabels:
      app: grafana
  template:
    metadata:
      name: grafana
      labels:
        app: grafana
    spec:
      # Deployment has PodAntiAffinity configured to ensure that
      # the scheduler does not co-locate replicas on a single node.
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - grafana
            topologyKey: "kubernetes.io/hostname"
      securityContext:
        fsGroup: 472
        runAsGroup: 472
        runAsNonRoot: true
        runAsUser: 472
      containers:
      - name: grafana
        image: grafana/grafana:7.3.7
        imagePullPolicy: IfNotPresent
        ports:
        - name: grafana
          containerPort: 3000
        resources:
          limits:
            memory: "2Gi"
            cpu: "1000m"
          requests: 
            memory: "1Gi"
            cpu: "500m"
        volumeMounts:
          - name: grafana-config
            mountPath: /etc/grafana/grafana.ini
            subPath: grafana.ini

          - name: grafana-storage
            mountPath: /var/lib/grafana

          - name: grafana-certs
            mountPath: /etc/grafana/certs/
            readOnly: true

          - name: grafana-datasources
            mountPath: /etc/grafana/provisioning/datasources/prometheus.yaml
            subPath: prometheus.yaml

          - name: grafana-dashboard-providers
            mountPath: /etc/grafana/provisioning/dashboards/dashboardproviders.yaml
            subPath: dashboardproviders.yaml

          - name: dashboards-k8s-cluster-summary
            mountPath: /var/lib/grafana/dashboards/k8s-cluster-summary

          - name: dashboards-node-exporter-full
            mountPath: /var/lib/grafana/dashboards/node-exporter-full

          - name: dashboards-etcd-summary
            mountPath: /var/lib/grafana/dashboards/etcd-summary

          - name: dashboards-bind-summary
            mountPath: /var/lib/grafana/dashboards/bind-summary

          - name: dashboards-haproxy-summary
            mountPath: /var/lib/grafana/dashboards/haproxy-summary

          - name: dashboards-mikrotik-summary
            mountPath: /var/lib/grafana/dashboards/mikrotik-summary

          - name: dashboards-x509-cert-summary
            mountPath: /var/lib/grafana/dashboards/x509-cert-summary

      # See https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
      #initContainers:
      #  - name: fix-nfs-permissions
      #    image: busybox
      #    command: ["sh", "-c", "chown -R 472:472 /var/lib/grafana"]
      #    securityContext:
      #      runAsUser: 0
      #      runAsNonRoot: false
      #    volumeMounts:
      #      - name: grafana-storage
      #        mountPath: /var/lib/grafana/

      restartPolicy: Always
      terminationGracePeriodSeconds: 60
      volumes:
        - name: grafana-config
          configMap:
            name: grafana-ini

        - name: grafana-storage
          persistentVolumeClaim:
            claimName: nfs-pvc-grafana

        - name: grafana-certs
          secret:
            secretName: grafana-tls-cert
            items:
            - key: tls.crt
              path: tls.crt
            - key: tls.key
              path: tls.key

        - name: grafana-datasources
          configMap:
            name: grafana-datasources

        - name: grafana-dashboard-providers
          configMap:
            name: grafana-dashboard-providers

        - name: dashboards-k8s-cluster-summary
          configMap:
            name: grafana-dashboards-k8s-cluster-summary

        - name: dashboards-node-exporter-full
          configMap:
            name: grafana-dashboards-node-exporter-full

        - name: dashboards-etcd-summary
          configMap:
            name: grafana-dashboards-etcd-summary

        - name: dashboards-bind-summary
          configMap:
            name: grafana-dashboards-bind-summary

        - name: dashboards-haproxy-summary
          configMap:
            name: grafana-dashboards-haproxy-summary

        - name: dashboards-mikrotik-summary
          configMap:
            name: grafana-dashboards-mikrotik-summary

        - name: dashboards-x509-cert-summary
          configMap:
            name: grafana-dashboards-x509-cert-summary
