apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: alertmanager
  namespace: open-cluster-management
  labels:
    app: multicluster-observability-alertmanager
    alertmanager: observability
spec:
  replicas: 3
  selector:
    matchLabels:
      app: multicluster-observability-alertmanager
      alertmanager: observability
  serviceName: alertmanager-operated
  template:
    metadata:
      labels:
        app: multicluster-observability-alertmanager
        alertmanager: observability
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 70
            podAffinityTerm:
              topologyKey: topology.kubernetes.io/zone
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - multicluster-observability-alertmanager
          - weight: 30
            podAffinityTerm:
              topologyKey: kubernetes.io/hostname
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - multicluster-observability-alertmanager
      containers:
      - args:
        - --config.file=/etc/alertmanager/config/alertmanager.yaml
        - --cluster.listen-address=[$(POD_IP)]:9094
        - --storage.path=/alertmanager
        - --data.retention=120h
        - --web.listen-address=127.0.0.1:9093
        - --web.route-prefix=/
        env:
        - name: POD_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        image: quay.io/open-cluster-management/prometheus-alertmanager:2.3.0-SNAPSHOT-2021-06-30-00-51-08
        imagePullPolicy: IfNotPresent
        name: alertmanager
        ports:
        - containerPort: 9094
          name: mesh-tcp
          protocol: TCP
        - containerPort: 9093
          name: web
          protocol: TCP
        - containerPort: 9094
          name: mesh-udp
          protocol: UDP
        resources:
          requests:
            cpu: 4m
            memory: 200Mi
        volumeMounts:
        - mountPath: /etc/alertmanager/config
          name: config-volume
        - mountPath: /alertmanager
          name: alertmanager-db
      - args:
        - -webhook-url=http://localhost:9093/-/reload
        - -volume-dir=/etc/alertmanager/config
        - -volume-dir=/etc/tls/private
        image: quay.io/openshift/origin-configmap-reloader:4.5.0
        imagePullPolicy: IfNotPresent
        name: config-reloader
        resources:
          requests:
            cpu: 4m
            memory: 25Mi
        volumeMounts:
        - mountPath: /etc/alertmanager/config
          name: config-volume
          readOnly: true
        - mountPath: /etc/tls/private
          name: tls-secret
          readOnly: true
      - args:
        - --provider=openshift
        - --https-address=:9095
        - --http-address=
        - --upstream=http://localhost:9093
        - --openshift-sar={"resource":"namespaces","verb":"get"}
        - --openshift-delegate-urls={"/":{"resource":"namespaces","verb":"get"}}
        - --tls-cert=/etc/tls/private/tls.crt
        - --tls-key=/etc/tls/private/tls.key
        # - --email-domain=*
        # - --scope=user:full
        # - --client-id=alertmanager
        # - --client-secret=alertmanagersecret
        - --openshift-service-account=alertmanager
        - --cookie-secret-file=/etc/proxy/secrets/session_secret
        - --skip-provider-button=true
        - --openshift-ca=/etc/pki/tls/cert.pem
        - --openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        image: quay.io/open-cluster-management/origin-oauth-proxy:2.0.11-SNAPSHOT-2021-04-29-18-29-17
        imagePullPolicy: IfNotPresent
        name: alertmanager-proxy
        ports:
        - containerPort: 9095
          name: oauth-proxy
          protocol: TCP
        resources:
          requests:
            cpu: 1m
            memory: 20Mi
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /oauth/healthz
            port: 9095
            scheme: HTTPS
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        volumeMounts:
        - mountPath: /etc/tls/private
          name: tls-secret
          readOnly: true
        - mountPath: /etc/proxy/secrets
          name: alertmanager-proxy
      serviceAccount: alertmanager
      serviceAccountName: alertmanager
      volumes:
      - name: config-volume
        secret:
          defaultMode: 420
          secretName: alertmanager-config
      - name: alertmanager-proxy
        secret:
          defaultMode: 420
          secretName: alertmanager-proxy
      - name: tls-secret
        secret:
          defaultMode: 420
          secretName: alertmanager-tls
  volumeClaimTemplates:
  - metadata:
      name: alertmanager-db
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 10Gi
      storageClassName: "gp2"
