apiVersion: apps/v1
kind: Deployment
metadata:
  name: pgbouncer
  labels:
    app: pgbouncer
spec:
  replicas: 2
  selector:
    matchLabels:
      app: pgbouncer
  template:
    metadata:
      labels:
        app: pgbouncer
    spec:

      serviceAccountName: postgres-vault

      initContainers:

        - name: vault-init
          image: everpeace/curl-jq
          command:
            - "sh"
            - "-c"
            - >
              KUBE_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token);
              curl --request POST --data '{"jwt": "'"$KUBE_TOKEN"'", "role": "postgres"}' http://{{VAULT_NAME}}:8200/v1/auth/kubernetes/login | jq -j '.auth.client_token' > /etc/vault/token;
              X_VAULT_TOKEN=$(cat /etc/vault/token);
              curl --header "X-Vault-Token: $X_VAULT_TOKEN" http://{{VAULT_NAME}}:8200/v1/database/creds/connection-pool-role > /etc/app/creds.json;
              cat /etc/app/creds.json | jq -j '.data.username' > /etc/app/username;
              cat /etc/app/creds.json | jq -j '.data.password' > /etc/app/password;
          volumeMounts:
            - name: app-creds
              mountPath: /etc/app
            - name: vault-token
              mountPath: /etc/vault

      containers:

        - name: pgbouncer
          image: pgbouncer/pgbouncer:1.11.0
          ports:
            - containerPort: 5432
          command:
            - "sh"
            - "-c"
            - >
              DB_USERNAME=$(cat /etc/app/username) && DB_PASSWORD=$(cat /etc/app/password) && echo "
                [databases]
                * = host = {{PGXL_SERVICE_NAME}} port=5432

                [pgbouncer]
                max_client_conn = 1000
                default_pool_size = 5
                max_db_connections = 100
                listen_addr = *
                listen_port = 5432
                auth_type = md5
                ignore_startup_parameters = extra_float_digits, intervalStyle
                auth_file = /etc/pgbouncer/userlist.txt
                auth_query = SELECT p_user, p_password FROM connection_pool.lookup(\$1)
                auth_user = ${DB_USERNAME}

                # Log settings
                admin_users = postgres" > /etc/pgbouncer/pgbouncer.ini;
              echo "\"${DB_USERNAME}\" \"${DB_PASSWORD}\"" > /etc/pgbouncer/userlist.txt;
              exec /opt/pgbouncer/pgbouncer /etc/pgbouncer/pgbouncer.ini;
          volumeMounts:
            - name: app-creds
              mountPath: /etc/app

        - name: vault-manager
          image: everpeace/curl-jq
          command:
            - "sh"
            - "-c"
            - >
              X_VAULT_TOKEN=$(cat /etc/vault/token);
              VAULT_LEASE_ID=$(cat /etc/app/creds.json | jq -j '.lease_id');
              while true; do
                curl --request PUT --header "X-Vault-Token: $X_VAULT_TOKEN" --data '{"lease_id": "'"$VAULT_LEASE_ID"'", "increment": 3600}' http://{{VAULT_NAME}}:8200/v1/sys/leases/renew;
                sleep 3600;
              done
          lifecycle:
            preStop:
              exec:
                command:
                  - "sh"
                  - "-c"
                  - >
                    X_VAULT_TOKEN=$(cat /etc/vault/token);
                    VAULT_LEASE_ID=$(cat /etc/app/creds.json | jq -j '.lease_id');
                    curl --request PUT --header "X-Vault-Token: $X_VAULT_TOKEN" --data '{"lease_id": "'"$VAULT_LEASE_ID"'"}' http://{{VAULT_NAME}}:8200/v1/sys/leases/revoke;
          volumeMounts:
            - name: app-creds
              mountPath: /etc/app
            - name: vault-token
              mountPath: /etc/vault

      volumes:
        - name: app-creds
          emptyDir: {}
        - name: vault-token
          emptyDir: {}
