---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vizier-metadata
spec:
  replicas: 1
  selector:
    matchLabels:
      name: vizier-metadata
  template:
    metadata:
      labels:
        name: vizier-metadata
        plane: control
    spec:
      serviceAccountName: metadata-service-account
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/os
                operator: Exists
              - key: kubernetes.io/os
                operator: In
                values:
                - linux
            - matchExpressions:
              - key: beta.kubernetes.io/os
                operator: Exists
              - key: beta.kubernetes.io/os
                operator: In
                values:
                - linux
      initContainers:
      - name: nats-wait
        image: gcr.io/pixie-oss/pixie-dev-public/curl:1.0
        # yamllint disable rule:indentation
        command: ['sh', '-c', 'set -xe;
          URL="${PROTOCOL}://${SERVICE_NAME}:${SERVICE_PORT}${HEALTH_PATH}";
          until [ $(curl -m 0.5 -s -o /dev/null -w "%{http_code}" -k ${URL}) -eq 200 ]; do
            echo "waiting for ${URL}";
            sleep 2;
          done;']
        # yamllint enable rule:indentation
        env:
        - name: SERVICE_NAME
          value: "pl-nats-mgmt"
        - name: SERVICE_PORT
          value: "8222"
        - name: HEALTH_PATH
          value: ""
        - name: PROTOCOL
          value: "http"
      - name: etcd-wait
        image: gcr.io/pixie-oss/pixie-dev-public/curl:1.0
        # yamllint disable rule:indentation rule:line-length
        command: ['sh', '-c', 'set -xe;
          ETCD_PATH="${PL_MD_ETCD_SERVER}";
          if [ ! ${ETCD_PATH} ]; then ETCD_PATH="${DEFAULT_ETCD_PATH}"; fi;
          URL="${ETCD_PATH}${HEALTH_PATH}";
          until [ $(curl --cacert /certs/ca.crt --key /certs/client.key --cert /certs/client.crt -m 0.5 -s -o /dev/null -w "%{http_code}" -k ${URL}) -eq 200 ]; do
            echo "waiting for ${URL}";
            sleep 2;
          done;']
        # yamllint enable rule:indentation rule:line-length
        env:
        - name: HEALTH_PATH
          value: "/health"
        - name: DEFAULT_ETCD_PATH
          value: "https://pl-etcd-client.pl.svc:2379"
        envFrom:
        - configMapRef:
            name: pl-cluster-config
            optional: true
        volumeMounts:
        - mountPath: /certs
          name: certs
      containers:
      - name: app
        image: gcr.io/pixie-oss/pixie-dev/vizier/metadata_server_image:latest
        env:
        - name: PL_JWT_SIGNING_KEY
          valueFrom:
            secretKeyRef:
              key: jwt-signing-key
              name: pl-cluster-secrets
        - name: PL_POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: PL_MAX_EXPECTED_CLOCK_SKEW
          value: "2000"
        - name: PL_RENEW_PERIOD
          value: "7500"
        envFrom:
        - configMapRef:
            name: pl-tls-config
        - configMapRef:
            name: pl-cluster-config
            optional: true
        volumeMounts:
        - mountPath: /certs
          name: certs
        livenessProbe:
          httpGet:
            scheme: HTTPS
            path: /healthz
            port: 50400
          initialDelaySeconds: 120
          periodSeconds: 10
        readinessProbe:
          httpGet:
            scheme: HTTPS
            path: /healthz
            port: 50400
          initialDelaySeconds: 30
          failureThreshold: 5
          periodSeconds: 10
      volumes:
      - name: certs
        secret:
          secretName: service-tls-certs
