apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app: enmasse
  name: address-space-definitions
data:
  standard-space-infra-without-mqtt.yaml: |-
    apiVersion: v1
    kind: Template
    metadata:
      labels:
        app: enmasse
      name: standard-space-infra-without-mqtt
    objects:
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/service-port.amqp: 5672
          enmasse.io/service-port.amqps: 5671
          io.enmasse.endpointPort: amqps
          service.alpha.openshift.io/dependencies: '[{"kind": "Service", "name": "queue-scheduler",
            "namespace": ""}, {"kind": "Service", "name": "configuration", "namespace":
            ""}, {"kind": "Service", "name": "ragent", "namespace": ""}, {"kind": "Service",
            "name": "console", "namespace": ""}, {"kind": "Service", "name": "subscription",
            "namespace": ""}, {"kind": "Service", "name": "mqtt", "namespace": ""}]'
          service.alpha.openshift.io/infrastructure: 'true'
        labels:
          app: enmasse
        name: messaging
      spec:
        ports:
        - name: amqp
          port: 5672
          protocol: TCP
          targetPort: 5672
        - name: amqps
          port: 5671
          protocol: TCP
          targetPort: 5671
        - name: amqps-normal
          port: 55671
          protocol: TCP
          targetPort: amqps-normal
        - name: amqps-broker
          port: 56671
          protocol: TCP
          targetPort: amqps-broker
        - name: inter-router
          port: 55672
          protocol: TCP
          targetPort: 55672
        selector:
          capability: router
    - apiVersion: v1
      data:
        config.yaml: '{"hostPort": "127.0.0.1:1099", "rules": [{"labels": {"address":
          "$2", "broker": "$1"}, "name": "artemis_message_count", "pattern": "org.apache.activemq.artemis<broker=\"(.+)\",
          component=addresses, address=\"(.+)\".*><>MessageCount", "type": "GAUGE"}],
          "ssl": true}'
      kind: ConfigMap
      metadata:
        name: broker-prometheus-config
    - apiVersion: extensions/v1beta1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-cn: router
          enmasse.io/cert-secret: router-internal-cert
          prometheus.io/path: /metrics
          prometheus.io/port: '8080'
          prometheus.io/scrape: 'true'
        labels:
          app: enmasse
          name: qdrouterd
        name: qdrouterd
      spec:
        replicas: 1
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              capability: router
              name: qdrouterd
          spec:
            containers:
            - env:
              - name: LINK_CAPACITY
                value: ${ROUTER_LINK_CAPACITY}
              - name: ALLOW_DURABLE_SUBSCRIPTIONS
                value: ${ALLOW_DURABLE_SUBSCRIPTIONS}
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: AUTHENTICATION_SERVICE_OAUTH_URL
                value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
              image: docker.io/enmasseproject/router:latest
              livenessProbe:
                initialDelaySeconds: 60
                tcpSocket:
                  port: amqp
              name: router
              ports:
              - containerPort: 5672
                name: amqp
                protocol: TCP
              - containerPort: 5671
                name: amqps
                protocol: TCP
              - containerPort: 55671
                name: amqps-normal
                protocol: TCP
              - containerPort: 56671
                name: amqps-broker
                protocol: TCP
              volumeMounts:
              - mountPath: /etc/qpid-dispatch/ssl
                name: ssl-certs
                readOnly: true
              - mountPath: /etc/qpid-dispatch/authservice-ca
                name: authservice-ca
                readOnly: true
              - mountPath: /etc/enmasse-certs
                name: router-internal-cert
                readOnly: true
            - env:
              - name: ROUTER_HOST
                value: 127.0.0.1
              - name: ROUTER_PORT
                value: '55671'
              - name: CERT_DIR
                value: /etc/enmasse-certs
              image: docker.io/enmasseproject/router-metrics:latest
              livenessProbe:
                initialDelaySeconds: 60
                tcpSocket:
                  port: routermetrics
              name: metrics
              ports:
              - containerPort: 8080
                name: routermetrics
                protocol: TCP
              resources:
                limits:
                  memory: 32Mi
                requests:
                  memory: 32Mi
              volumeMounts:
              - mountPath: /etc/enmasse-certs
                name: router-internal-cert
                readOnly: true
            volumes:
            - name: ssl-certs
              secret:
                secretName: ${MESSAGING_SECRET}
            - name: authservice-ca
              secret:
                secretName: authservice-ca
            - name: router-internal-cert
              secret:
                secretName: router-internal-cert
    - apiVersion: v1
      data:
        tls.crt: ${AUTHENTICATION_SERVICE_CA_CERT}
      kind: Secret
      metadata:
        name: authservice-ca
    - apiVersion: extensions/v1beta1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-secret: admin-internal-cert
        labels:
          app: enmasse
          name: admin
        name: admin
      spec:
        replicas: 1
        strategy:
          type: Recreate
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              name: admin
          spec:
            containers:
            - env:
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: TEMPLATE_DIR
                value: /broker-templates
              - name: ADDRESS_SPACE
                value: ${ADDRESS_SPACE}
              - name: RESYNC_INTERVAL
                value: ${CONTROLLER_RESYNC_INTERVAL}
              - name: CHECK_INTERVAL
                value: ${CONTROLLER_CHECK_INTERVAL}
              - name: EVENT_QUEUE_SIZE
                value: ${CONTROLLER_EVENT_QUEUE_SIZE}
              - name: ENABLE_EVENT_LOGGER
                value: ${ENABLE_EVENT_LOGGER}
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CA_SECRET
                value: authservice-ca
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: JAVA_OPTS
                value: -verbose:gc
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: MESSAGING_SECRET
                value: ${MESSAGING_SECRET}
              image: docker.io/enmasseproject/standard-controller:latest
              livenessProbe:
                httpGet:
                  path: /health
                  port: http
                  scheme: HTTP
                initialDelaySeconds: 30
              name: standard-controller
              ports:
              - containerPort: 8889
                name: http
              readinessProbe:
                httpGet:
                  path: /health
                  port: http
                  scheme: HTTP
                initialDelaySeconds: 30
              resources:
                limits:
                  memory: 512Mi
                requests:
                  memory: 512Mi
              volumeMounts:
              - mountPath: /etc/enmasse-certs
                name: admin-internal-cert
                readOnly: true
              - mountPath: /broker-templates
                name: broker-templates
                readOnly: true
            - env:
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CA_SECRET
                value: authservice-ca
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: AUTHENTICATION_SERVICE_OAUTH_URL
                value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
              - name: ADDRESS_SPACE
                value: ${ADDRESS_SPACE}
              - name: ADDRESS_SPACE_NAMESPACE
                value: ${ADDRESS_SPACE_NAMESPACE}
              - name: MESSAGING_CERT
                value: /opt/agent/messaging-cert/tls.crt
              image: docker.io/enmasseproject/agent:latest
              livenessProbe:
                httpGet:
                  path: /probe
                  port: http
                  scheme: HTTP
                periodSeconds: 30
                timeoutSeconds: 5
              name: agent
              ports:
              - containerPort: 8888
                name: http
              - containerPort: 8080
                name: https
              - containerPort: 56720
                name: amqp-ws
              readinessProbe:
                httpGet:
                  path: /probe
                  port: http
                  scheme: HTTP
                periodSeconds: 30
                timeoutSeconds: 5
              resources:
                limits:
                  memory: 512Mi
                requests:
                  memory: 128Mi
              volumeMounts:
              - mountPath: /etc/console-certs
                name: console-secret
                readOnly: true
              - mountPath: /opt/agent/authservice-ca
                name: authservice-ca
                readOnly: true
              - mountPath: /etc/enmasse-certs
                name: admin-internal-cert
                readOnly: true
              - mountPath: /opt/agent/messaging-cert
                name: messaging-cert
                readOnly: true
            serviceAccount: ${ADDRESS_SPACE_ADMIN_SA}
            volumes:
            - name: console-secret
              secret:
                secretName: ${CONSOLE_SECRET}
            - name: authservice-ca
              secret:
                secretName: authservice-ca
            - name: admin-internal-cert
              secret:
                secretName: admin-internal-cert
            - name: messaging-cert
              secret:
                secretName: ${MESSAGING_SECRET}
            - name: broker-templates
              configMap:
                name: broker-templates
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
        name: ragent
      spec:
        ports:
        - name: amqp
          port: 5671
          targetPort: 55671
        selector:
          name: admin
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
        name: queue-scheduler
      spec:
        ports:
        - name: amqp
          port: 5672
          targetPort: 55671
        selector:
          name: admin
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          io.enmasse.endpointPort: https
        labels:
          app: enmasse
        name: console
      spec:
        ports:
        - name: https
          port: 8081
          targetPort: 8080
        selector:
          name: admin
    - apiVersion: v1
      kind: ConfigMap
      metadata:
        labels:
          app: enmasse
        name: broker-templates
      data:
        queue-persisted.yaml: |-
          apiVersion: v1
          kind: Template
          metadata:
            labels:
              app: enmasse
            name: queue-persisted
          objects:
          - apiVersion: v1
            kind: Service
            metadata:
              annotations:
                addressSpace: ${ADDRESS_SPACE}
                cluster_id: ${CLUSTER_ID}
              labels:
                app: enmasse
              name: ${NAME}
            spec:
              clusterIP: None
              selector:
                name: ${NAME}
                role: broker
          - apiVersion: apps/v1beta1
            kind: StatefulSet
            metadata:
              annotations:
                address: ${ADDRESS}
                addressSpace: ${ADDRESS_SPACE}
                cluster_id: ${CLUSTER_ID}
                enmasse.io/cert-cn: broker
                enmasse.io/cert-secret: broker-internal-cert
              labels:
                app: enmasse
              name: ${NAME}
            spec:
              replicas: 1
              serviceName: ${NAME}
              template:
                metadata:
                  annotations:
                    address: ${ADDRESS}
                    addressSpace: ${ADDRESS_SPACE}
                    cluster_id: ${CLUSTER_ID}
                    prometheus.io/path: /metrics
                    prometheus.io/port: '8080'
                    prometheus.io/scrape: 'true'
                  labels:
                    addresstype: queue
                    app: enmasse
                    name: ${NAME}
                    role: broker
                spec:
                  containers:
                  - env:
                    - name: QUEUE_NAME
                      value: ${ADDRESS}
                    - name: CLUSTER_ID
                      value: ${CLUSTER_ID}
                    - name: CERT_DIR
                      value: /etc/enmasse-certs
                    - name: GLOBAL_MAX_SIZE
                      value: ${GLOBAL_MAX_SIZE}
                    - name: AUTHENTICATION_SERVICE_HOST
                      value: ${AUTHENTICATION_SERVICE_HOST}
                    - name: AUTHENTICATION_SERVICE_PORT
                      value: ${AUTHENTICATION_SERVICE_PORT}
                    - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                      value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
                    - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                      value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
                    - name: AUTHENTICATION_SERVICE_OAUTH_URL
                      value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
                    image: docker.io/enmasseproject/artemis:latest
                    lifecycle:
                      preStop:
                        exec:
                          command:
                          - /shutdown-hook/shutdown-hook.sh
                    livenessProbe:
                      exec:
                        command:
                        - sh
                        - -c
                        - $ARTEMIS_HOME/bin/probe.sh
                      initialDelaySeconds: 120
                    name: broker
                    ports:
                    - containerPort: 5673
                      name: amqp
                    - containerPort: 8161
                      name: jolokia
                    - containerPort: 8080
                      name: artemismetrics
                    readinessProbe:
                      exec:
                        command:
                        - sh
                        - -c
                        - $ARTEMIS_HOME/bin/probe.sh
                      initialDelaySeconds: 10
                    resources:
                      limits:
                        memory: ${BROKER_MEMORY_LIMIT}
                      requests:
                        memory: ${BROKER_MEMORY_LIMIT}
                    volumeMounts:
                    - mountPath: /var/run/artemis
                      name: ${NAME}
                      readOnly: false
                    - mountPath: /etc/enmasse-certs
                      name: broker-internal-cert
                      readOnly: true
                    - mountPath: /etc/authservice-ca
                      name: authservice-ca
                      readOnly: true
                    - mountPath: /etc/prometheus-config
                      name: broker-prometheus-config
                      readOnly: true
                  volumes:
                  - name: ssl-certs
                    secret:
                      secretName: ${COLOCATED_ROUTER_SECRET}
                  - name: authservice-ca
                    secret:
                      secretName: authservice-ca
                  - name: broker-internal-cert
                    secret:
                      secretName: broker-internal-cert
                  - configMap:
                      name: broker-prometheus-config
                    name: broker-prometheus-config
              volumeClaimTemplates:
              - apiVersion: v1
                kind: PersistentVolumeClaim
                metadata:
                  annotations:
                    addressSpace: ${ADDRESS_SPACE}
                    cluster_id: ${CLUSTER_ID}
                  labels:
                    app: enmasse
                  name: ${NAME}
                spec:
                  accessModes:
                  - ReadWriteOnce
                  resources:
                    requests:
                      storage: ${STORAGE_CAPACITY}
          parameters:
          - description: Storage capacity required for volume claims
            name: STORAGE_CAPACITY
            value: 2Gi
          - description: The link capacity setting for router
            name: ROUTER_LINK_CAPACITY
            value: '50'
          - description: A valid addressSpace name for the address Space
            name: ADDRESS_SPACE
            required: true
          - description: A valid name for the deployment
            name: NAME
            required: true
          - description: A valid group id for the deployment
            name: CLUSTER_ID
            required: true
          - description: The address to use for the queue
            name: ADDRESS
            value: ''
          - description: Name of secret containing router key and certificate
            name: COLOCATED_ROUTER_SECRET
            required: true
          - description: The hostname of the authentication service used by this address
              space
            name: AUTHENTICATION_SERVICE_HOST
            required: true
          - description: The port of the authentication service used by this address space
            name: AUTHENTICATION_SERVICE_PORT
            required: true
          - description: The secret to use for validating authentication service cert
            name: AUTHENTICATION_SERVICE_CA_SECRET
            required: true
          - description: The client cert to use as identity against authentication service
            name: AUTHENTICATION_SERVICE_CLIENT_SECRET
          - description: The hostname to use in sasl init
            name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
          - description: Memory limits for container
            name: BROKER_MEMORY_LIMIT
            value: 512Mi
          - description: Global max size for all addresses in broker. Cannot be larger than
              a quarter of BROKER_MEMORY_LIMIT
            name: GLOBAL_MAX_SIZE
            value: 128Mb
        topic-persisted.yaml: |-
          apiVersion: v1
          kind: Template
          metadata:
            labels:
              app: enmasse
            name: topic-persisted
          objects:
          - apiVersion: v1
            kind: Service
            metadata:
              annotations:
                addressSpace: ${ADDRESS_SPACE}
                cluster_id: ${CLUSTER_ID}
              labels:
                app: enmasse
              name: ${NAME}
            spec:
              clusterIP: None
              selector:
                name: ${NAME}
                role: broker
          - apiVersion: apps/v1beta1
            kind: StatefulSet
            metadata:
              annotations:
                address: ${ADDRESS}
                addressSpace: ${ADDRESS_SPACE}
                cluster_id: ${CLUSTER_ID}
                enmasse.io/cert-cn: broker
                enmasse.io/cert-secret: broker-internal-cert
              labels:
                app: enmasse
              name: ${NAME}
            spec:
              replicas: 1
              serviceName: ${NAME}
              template:
                metadata:
                  annotations:
                    address: ${ADDRESS}
                    addressSpace: ${ADDRESS_SPACE}
                    cluster_id: ${CLUSTER_ID}
                    prometheus.io/path: /metrics
                    prometheus.io/port: '8080'
                    prometheus.io/scrape: 'true'
                  labels:
                    addresstype: topic
                    app: enmasse
                    name: ${NAME}
                    role: broker
                spec:
                  containers:
                  - env:
                    - name: TOPIC_NAME
                      value: ${ADDRESS}
                    - name: CLUSTER_ID
                      value: ${CLUSTER_ID}
                    - name: CERT_DIR
                      value: /etc/enmasse-certs
                    - name: GLOBAL_MAX_SIZE
                      value: ${GLOBAL_MAX_SIZE}
                    - name: AUTHENTICATION_SERVICE_HOST
                      value: ${AUTHENTICATION_SERVICE_HOST}
                    - name: AUTHENTICATION_SERVICE_PORT
                      value: ${AUTHENTICATION_SERVICE_PORT}
                    - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                      value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
                    - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                      value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
                    - name: AUTHENTICATION_SERVICE_OAUTH_URL
                      value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
                    image: docker.io/enmasseproject/artemis:latest
                    lifecycle:
                      preStop:
                        exec:
                          command:
                          - /shutdown-hook/shutdown-hook.sh
                    livenessProbe:
                      exec:
                        command:
                        - sh
                        - -c
                        - $ARTEMIS_HOME/bin/probe.sh
                      initialDelaySeconds: 120
                    name: broker
                    ports:
                    - containerPort: 5673
                      name: amqp
                    - containerPort: 8161
                      name: jolokia
                    - containerPort: 8080
                      name: artemismetrics
                    readinessProbe:
                      exec:
                        command:
                        - sh
                        - -c
                        - $ARTEMIS_HOME/bin/probe.sh
                      initialDelaySeconds: 10
                    resources:
                      limits:
                        memory: ${BROKER_MEMORY_LIMIT}
                      requests:
                        memory: ${BROKER_MEMORY_LIMIT}
                    volumeMounts:
                    - mountPath: /var/run/artemis
                      name: ${NAME}
                      readOnly: false
                    - mountPath: /etc/enmasse-certs
                      name: broker-internal-cert
                      readOnly: true
                    - mountPath: /etc/authservice-ca
                      name: authservice-ca
                      readOnly: true
                    - mountPath: /etc/prometheus-config
                      name: broker-prometheus-config
                      readOnly: true
                  - env:
                    - name: TOPIC_NAME
                      value: ${ADDRESS}
                    - name: LINK_CAPACITY
                      value: ${ROUTER_LINK_CAPACITY}
                    - name: ALLOW_DURABLE_SUBSCRIPTIONS
                      value: ${ALLOW_DURABLE_SUBSCRIPTIONS}
                    - name: AUTHENTICATION_SERVICE_HOST
                      value: ${AUTHENTICATION_SERVICE_HOST}
                    - name: AUTHENTICATION_SERVICE_PORT
                      value: ${AUTHENTICATION_SERVICE_PORT}
                    - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                      value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
                    - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                      value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
                    - name: AUTHENTICATION_SERVICE_OAUTH_URL
                      value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
                    image: docker.io/enmasseproject/router:latest
                    livenessProbe:
                      initialDelaySeconds: 60
                      tcpSocket:
                        port: amqp
                    name: router
                    ports:
                    - containerPort: 5672
                      name: amqp
                      protocol: TCP
                    - containerPort: 5671
                      name: amqps
                      protocol: TCP
                    - containerPort: 55671
                      name: amqps-normal
                      protocol: TCP
                    - containerPort: 56671
                      name: amqps-broker
                      protocol: TCP
                    resources:
                      limits:
                        memory: 256Mi
                      requests:
                        memory: 256Mi
                    volumeMounts:
                    - mountPath: /etc/qpid-dispatch/ssl
                      name: ssl-certs
                      readOnly: true
                    - mountPath: /etc/qpid-dispatch/authservice-ca
                      name: authservice-ca
                      readOnly: true
                    - mountPath: /etc/enmasse-certs
                      name: broker-internal-cert
                      readOnly: true
                  - env:
                    - name: TOPIC_NAME
                      value: ${ADDRESS}
                    - name: CLUSTER_ID
                      value: ${NAME}
                    - name: CERT_DIR
                      value: /etc/enmasse-certs
                    image: docker.io/enmasseproject/topic-forwarder:latest
                    livenessProbe:
                      httpGet:
                        path: /health
                        port: health
                      initialDelaySeconds: 60
                    name: forwarder
                    ports:
                    - containerPort: 8088
                      name: health
                    resources:
                      limits:
                        memory: 128Mi
                      requests:
                        memory: 128Mi
                    volumeMounts:
                    - mountPath: /etc/enmasse-certs
                      name: broker-internal-cert
                      readOnly: true
                  volumes:
                  - name: ssl-certs
                    secret:
                      secretName: ${COLOCATED_ROUTER_SECRET}
                  - name: authservice-ca
                    secret:
                      secretName: authservice-ca
                  - name: broker-internal-cert
                    secret:
                      secretName: broker-internal-cert
                  - configMap:
                      name: broker-prometheus-config
                    name: broker-prometheus-config
              volumeClaimTemplates:
              - apiVersion: v1
                kind: PersistentVolumeClaim
                metadata:
                  annotations:
                    addressSpace: ${ADDRESS_SPACE}
                    cluster_id: ${CLUSTER_ID}
                  labels:
                    app: enmasse
                  name: ${NAME}
                spec:
                  accessModes:
                  - ReadWriteOnce
                  resources:
                    requests:
                      storage: ${STORAGE_CAPACITY}
          parameters:
          - description: Storage capacity required for volume claims
            name: STORAGE_CAPACITY
            value: 2Gi
          - description: The link capacity setting for router
            name: ROUTER_LINK_CAPACITY
            value: '50'
          - description: A valid addressSpace name for the address Space
            name: ADDRESS_SPACE
            required: true
          - description: A valid name for the deployment
            name: NAME
            required: true
          - description: A valid group id for the deployment
            name: CLUSTER_ID
            required: true
          - description: The address to use for the topic
            name: ADDRESS
            value: ''
          - description: Name of secret containing router key and certificate
            name: COLOCATED_ROUTER_SECRET
            required: true
          - description: The hostname of the authentication service used by this address
              space
            name: AUTHENTICATION_SERVICE_HOST
            required: true
          - description: The port of the authentication service used by this address space
            name: AUTHENTICATION_SERVICE_PORT
            required: true
          - description: The secret to use for validating authentication service cert
            name: AUTHENTICATION_SERVICE_CA_SECRET
            required: true
          - description: The client cert to use as identity against authentication service
            name: AUTHENTICATION_SERVICE_CLIENT_SECRET
          - description: The hostname to use in sasl init
            name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
          - description: Memory limits for container
            name: BROKER_MEMORY_LIMIT
            value: 512Mi
          - description: Global max size for all addresses in broker. Cannot be larger than
              a quarter of BROKER_MEMORY_LIMIT
            name: GLOBAL_MAX_SIZE
            value: 128Mb
    parameters:
    - description: The link capacity setting for router
      name: ROUTER_LINK_CAPACITY
      value: '50'
    - description: Whether AMQP based durable subscriptions to topics are allowed
      name: ALLOW_DURABLE_SUBSCRIPTIONS
      value: 'true'
    - description: The hostname to use for the exposed route for messaging
      name: MESSAGING_HOSTNAME
    - description: The hostname to use for the exposed route for MQTT
      name: MQTT_GATEWAY_HOSTNAME
    - description: The hostname to use for the exposed route for the messaging console
      name: CONSOLE_HOSTNAME
    - description: The secret with cert for the console
      name: CONSOLE_SECRET
      required: true
    - description: The secret with cert for the messaging service
      name: MESSAGING_SECRET
      required: true
    - description: The secret to mount for MQTT private key and certificate
      name: MQTT_SECRET
      required: true
    - description: The name of our address space
      name: ADDRESS_SPACE
      required: true
    - description: The namespace of our address space
      name: ADDRESS_SPACE_NAMESPACE
      required: true
    - description: The hostname of the authentication service used by this address space
      name: AUTHENTICATION_SERVICE_HOST
      required: true
    - description: The port of the authentication service used by this address space
      name: AUTHENTICATION_SERVICE_PORT
      required: true
    - description: The CA cert to use for validating authentication service cert
      name: AUTHENTICATION_SERVICE_CA_CERT
      required: true
    - description: The client cert to use as identity against authentication service
      name: AUTHENTICATION_SERVICE_CLIENT_SECRET
    - description: The hostname to use in sasl init
      name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
    - description: The URL to use for OAUTH (if not set, OAUTH is not used)
      name: AUTHENTICATION_SERVICE_OAUTH_URL
    - description: Enable logging of kubernetes events
      name: ENABLE_EVENT_LOGGER
      value: 'false'
    - description: Interval (in seconds) to use between controller resync
      name: CONTROLLER_RESYNC_INTERVAL
      value: '600'
    - description: Interval (in seconds) to use between status checks
      name: CONTROLLER_CHECK_INTERVAL
      value: '30'
    - description: Max number of events queued up for controller
      name: CONTROLLER_EVENT_QUEUE_SIZE
      value: '10000'
    - description: The service account with address space admin privileges
      name: ADDRESS_SPACE_ADMIN_SA
      value: address-space-admin
  standard-space-infra.yaml: |-
    apiVersion: v1
    kind: Template
    metadata:
      labels:
        app: enmasse
      name: standard-space-infra
    objects:
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/service-port.amqp: 5672
          enmasse.io/service-port.amqps: 5671
          io.enmasse.endpointPort: amqps
          service.alpha.openshift.io/dependencies: '[{"kind": "Service", "name": "queue-scheduler",
            "namespace": ""}, {"kind": "Service", "name": "configuration", "namespace":
            ""}, {"kind": "Service", "name": "ragent", "namespace": ""}, {"kind": "Service",
            "name": "console", "namespace": ""}, {"kind": "Service", "name": "subscription",
            "namespace": ""}, {"kind": "Service", "name": "mqtt", "namespace": ""}]'
          service.alpha.openshift.io/infrastructure: 'true'
        labels:
          app: enmasse
        name: messaging
      spec:
        ports:
        - name: amqp
          port: 5672
          protocol: TCP
          targetPort: 5672
        - name: amqps
          port: 5671
          protocol: TCP
          targetPort: 5671
        - name: amqps-normal
          port: 55671
          protocol: TCP
          targetPort: amqps-normal
        - name: amqps-broker
          port: 56671
          protocol: TCP
          targetPort: amqps-broker
        - name: inter-router
          port: 55672
          protocol: TCP
          targetPort: 55672
        selector:
          capability: router
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
        name: subscription
      spec:
        ports:
        - name: amqp
          port: 5672
          protocol: TCP
          targetPort: 5672
        selector:
          name: subserv
    - apiVersion: v1
      data:
        config.yaml: '{"hostPort": "127.0.0.1:1099", "rules": [{"labels": {"address":
          "$2", "broker": "$1"}, "name": "artemis_message_count", "pattern": "org.apache.activemq.artemis<broker=\"(.+)\",
          component=addresses, address=\"(.+)\".*><>MessageCount", "type": "GAUGE"}],
          "ssl": true}'
      kind: ConfigMap
      metadata:
        name: broker-prometheus-config
    - apiVersion: extensions/v1beta1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-cn: router
          enmasse.io/cert-secret: router-internal-cert
          prometheus.io/path: /metrics
          prometheus.io/port: '8080'
          prometheus.io/scrape: 'true'
        labels:
          app: enmasse
          name: qdrouterd
        name: qdrouterd
      spec:
        replicas: 1
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              capability: router
              name: qdrouterd
          spec:
            containers:
            - env:
              - name: LINK_CAPACITY
                value: ${ROUTER_LINK_CAPACITY}
              - name: ALLOW_DURABLE_SUBSCRIPTIONS
                value: ${ALLOW_DURABLE_SUBSCRIPTIONS}
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: AUTHENTICATION_SERVICE_OAUTH_URL
                value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
              image: docker.io/enmasseproject/router:latest
              livenessProbe:
                initialDelaySeconds: 60
                tcpSocket:
                  port: amqp
              name: router
              ports:
              - containerPort: 5672
                name: amqp
                protocol: TCP
              - containerPort: 5671
                name: amqps
                protocol: TCP
              - containerPort: 55671
                name: amqps-normal
                protocol: TCP
              - containerPort: 56671
                name: amqps-broker
                protocol: TCP
              volumeMounts:
              - mountPath: /etc/qpid-dispatch/ssl
                name: ssl-certs
                readOnly: true
              - mountPath: /etc/qpid-dispatch/authservice-ca
                name: authservice-ca
                readOnly: true
              - mountPath: /etc/enmasse-certs
                name: router-internal-cert
                readOnly: true
            - env:
              - name: ROUTER_HOST
                value: 127.0.0.1
              - name: ROUTER_PORT
                value: '55671'
              - name: CERT_DIR
                value: /etc/enmasse-certs
              image: docker.io/enmasseproject/router-metrics:latest
              livenessProbe:
                initialDelaySeconds: 60
                tcpSocket:
                  port: routermetrics
              name: metrics
              ports:
              - containerPort: 8080
                name: routermetrics
                protocol: TCP
              resources:
                limits:
                  memory: 32Mi
                requests:
                  memory: 32Mi
              volumeMounts:
              - mountPath: /etc/enmasse-certs
                name: router-internal-cert
                readOnly: true
            volumes:
            - name: ssl-certs
              secret:
                secretName: ${MESSAGING_SECRET}
            - name: authservice-ca
              secret:
                secretName: authservice-ca
            - name: router-internal-cert
              secret:
                secretName: router-internal-cert
    - apiVersion: v1
      data:
        tls.crt: ${AUTHENTICATION_SERVICE_CA_CERT}
      kind: Secret
      metadata:
        name: authservice-ca
    - apiVersion: extensions/v1beta1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-secret: admin-internal-cert
        labels:
          app: enmasse
          name: admin
        name: admin
      spec:
        replicas: 1
        strategy:
          type: Recreate
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              name: admin
          spec:
            containers:
            - env:
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: TEMPLATE_DIR
                value: /broker-templates
              - name: ADDRESS_SPACE
                value: ${ADDRESS_SPACE}
              - name: RESYNC_INTERVAL
                value: ${CONTROLLER_RESYNC_INTERVAL}
              - name: CHECK_INTERVAL
                value: ${CONTROLLER_CHECK_INTERVAL}
              - name: EVENT_QUEUE_SIZE
                value: ${CONTROLLER_EVENT_QUEUE_SIZE}
              - name: ENABLE_EVENT_LOGGER
                value: ${ENABLE_EVENT_LOGGER}
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CA_SECRET
                value: authservice-ca
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: JAVA_OPTS
                value: -verbose:gc
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: MESSAGING_SECRET
                value: ${MESSAGING_SECRET}
              image: docker.io/enmasseproject/standard-controller:latest
              livenessProbe:
                httpGet:
                  path: /health
                  port: http
                  scheme: HTTP
                initialDelaySeconds: 30
              name: standard-controller
              ports:
              - containerPort: 8889
                name: http
              readinessProbe:
                httpGet:
                  path: /health
                  port: http
                  scheme: HTTP
                initialDelaySeconds: 30
              resources:
                limits:
                  memory: 512Mi
                requests:
                  memory: 512Mi
              volumeMounts:
              - mountPath: /etc/enmasse-certs
                name: admin-internal-cert
                readOnly: true
              - mountPath: /broker-templates
                name: broker-templates
                readOnly: true
            - env:
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CA_SECRET
                value: authservice-ca
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: AUTHENTICATION_SERVICE_OAUTH_URL
                value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
              - name: ADDRESS_SPACE
                value: ${ADDRESS_SPACE}
              - name: ADDRESS_SPACE_NAMESPACE
                value: ${ADDRESS_SPACE_NAMESPACE}
              - name: MESSAGING_CERT
                value: /opt/agent/messaging-cert/tls.crt
              image: docker.io/enmasseproject/agent:latest
              livenessProbe:
                httpGet:
                  path: /probe
                  port: http
                  scheme: HTTP
                periodSeconds: 30
                timeoutSeconds: 5
              name: agent
              ports:
              - containerPort: 8888
                name: http
              - containerPort: 8080
                name: https
              - containerPort: 56720
                name: amqp-ws
              readinessProbe:
                httpGet:
                  path: /probe
                  port: http
                  scheme: HTTP
                periodSeconds: 30
                timeoutSeconds: 5
              resources:
                limits:
                  memory: 512Mi
                requests:
                  memory: 128Mi
              volumeMounts:
              - mountPath: /etc/console-certs
                name: console-secret
                readOnly: true
              - mountPath: /opt/agent/authservice-ca
                name: authservice-ca
                readOnly: true
              - mountPath: /etc/enmasse-certs
                name: admin-internal-cert
                readOnly: true
              - mountPath: /opt/agent/messaging-cert
                name: messaging-cert
                readOnly: true
            serviceAccount: ${ADDRESS_SPACE_ADMIN_SA}
            volumes:
            - name: console-secret
              secret:
                secretName: ${CONSOLE_SECRET}
            - name: authservice-ca
              secret:
                secretName: authservice-ca
            - name: admin-internal-cert
              secret:
                secretName: admin-internal-cert
            - name: messaging-cert
              secret:
                secretName: ${MESSAGING_SECRET}
            - name: broker-templates
              configMap:
                name: broker-templates
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
        name: ragent
      spec:
        ports:
        - name: amqp
          port: 5671
          targetPort: 55671
        selector:
          name: admin
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
        name: queue-scheduler
      spec:
        ports:
        - name: amqp
          port: 5672
          targetPort: 55671
        selector:
          name: admin
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          io.enmasse.endpointPort: https
        labels:
          app: enmasse
        name: console
      spec:
        ports:
        - name: https
          port: 8081
          targetPort: 8080
        selector:
          name: admin
    - apiVersion: v1
      kind: ConfigMap
      metadata:
        labels:
          app: enmasse
        name: broker-templates
      data:
        queue-persisted.yaml: |-
          apiVersion: v1
          kind: Template
          metadata:
            labels:
              app: enmasse
            name: queue-persisted
          objects:
          - apiVersion: v1
            kind: Service
            metadata:
              annotations:
                addressSpace: ${ADDRESS_SPACE}
                cluster_id: ${CLUSTER_ID}
              labels:
                app: enmasse
              name: ${NAME}
            spec:
              clusterIP: None
              selector:
                name: ${NAME}
                role: broker
          - apiVersion: apps/v1beta1
            kind: StatefulSet
            metadata:
              annotations:
                address: ${ADDRESS}
                addressSpace: ${ADDRESS_SPACE}
                cluster_id: ${CLUSTER_ID}
                enmasse.io/cert-cn: broker
                enmasse.io/cert-secret: broker-internal-cert
              labels:
                app: enmasse
              name: ${NAME}
            spec:
              replicas: 1
              serviceName: ${NAME}
              template:
                metadata:
                  annotations:
                    address: ${ADDRESS}
                    addressSpace: ${ADDRESS_SPACE}
                    cluster_id: ${CLUSTER_ID}
                    prometheus.io/path: /metrics
                    prometheus.io/port: '8080'
                    prometheus.io/scrape: 'true'
                  labels:
                    addresstype: queue
                    app: enmasse
                    name: ${NAME}
                    role: broker
                spec:
                  containers:
                  - env:
                    - name: QUEUE_NAME
                      value: ${ADDRESS}
                    - name: CLUSTER_ID
                      value: ${CLUSTER_ID}
                    - name: CERT_DIR
                      value: /etc/enmasse-certs
                    - name: GLOBAL_MAX_SIZE
                      value: ${GLOBAL_MAX_SIZE}
                    - name: AUTHENTICATION_SERVICE_HOST
                      value: ${AUTHENTICATION_SERVICE_HOST}
                    - name: AUTHENTICATION_SERVICE_PORT
                      value: ${AUTHENTICATION_SERVICE_PORT}
                    - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                      value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
                    - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                      value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
                    - name: AUTHENTICATION_SERVICE_OAUTH_URL
                      value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
                    image: docker.io/enmasseproject/artemis:latest
                    lifecycle:
                      preStop:
                        exec:
                          command:
                          - /shutdown-hook/shutdown-hook.sh
                    livenessProbe:
                      exec:
                        command:
                        - sh
                        - -c
                        - $ARTEMIS_HOME/bin/probe.sh
                      initialDelaySeconds: 120
                    name: broker
                    ports:
                    - containerPort: 5673
                      name: amqp
                    - containerPort: 8161
                      name: jolokia
                    - containerPort: 8080
                      name: artemismetrics
                    readinessProbe:
                      exec:
                        command:
                        - sh
                        - -c
                        - $ARTEMIS_HOME/bin/probe.sh
                      initialDelaySeconds: 10
                    resources:
                      limits:
                        memory: ${BROKER_MEMORY_LIMIT}
                      requests:
                        memory: ${BROKER_MEMORY_LIMIT}
                    volumeMounts:
                    - mountPath: /var/run/artemis
                      name: ${NAME}
                      readOnly: false
                    - mountPath: /etc/enmasse-certs
                      name: broker-internal-cert
                      readOnly: true
                    - mountPath: /etc/authservice-ca
                      name: authservice-ca
                      readOnly: true
                    - mountPath: /etc/prometheus-config
                      name: broker-prometheus-config
                      readOnly: true
                  volumes:
                  - name: ssl-certs
                    secret:
                      secretName: ${COLOCATED_ROUTER_SECRET}
                  - name: authservice-ca
                    secret:
                      secretName: authservice-ca
                  - name: broker-internal-cert
                    secret:
                      secretName: broker-internal-cert
                  - configMap:
                      name: broker-prometheus-config
                    name: broker-prometheus-config
              volumeClaimTemplates:
              - apiVersion: v1
                kind: PersistentVolumeClaim
                metadata:
                  annotations:
                    addressSpace: ${ADDRESS_SPACE}
                    cluster_id: ${CLUSTER_ID}
                  labels:
                    app: enmasse
                  name: ${NAME}
                spec:
                  accessModes:
                  - ReadWriteOnce
                  resources:
                    requests:
                      storage: ${STORAGE_CAPACITY}
          parameters:
          - description: Storage capacity required for volume claims
            name: STORAGE_CAPACITY
            value: 2Gi
          - description: The link capacity setting for router
            name: ROUTER_LINK_CAPACITY
            value: '50'
          - description: A valid addressSpace name for the address Space
            name: ADDRESS_SPACE
            required: true
          - description: A valid name for the deployment
            name: NAME
            required: true
          - description: A valid group id for the deployment
            name: CLUSTER_ID
            required: true
          - description: The address to use for the queue
            name: ADDRESS
            value: ''
          - description: Name of secret containing router key and certificate
            name: COLOCATED_ROUTER_SECRET
            required: true
          - description: The hostname of the authentication service used by this address
              space
            name: AUTHENTICATION_SERVICE_HOST
            required: true
          - description: The port of the authentication service used by this address space
            name: AUTHENTICATION_SERVICE_PORT
            required: true
          - description: The secret to use for validating authentication service cert
            name: AUTHENTICATION_SERVICE_CA_SECRET
            required: true
          - description: The client cert to use as identity against authentication service
            name: AUTHENTICATION_SERVICE_CLIENT_SECRET
          - description: The hostname to use in sasl init
            name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
          - description: Memory limits for container
            name: BROKER_MEMORY_LIMIT
            value: 512Mi
          - description: Global max size for all addresses in broker. Cannot be larger than
              a quarter of BROKER_MEMORY_LIMIT
            name: GLOBAL_MAX_SIZE
            value: 128Mb
        topic-persisted.yaml: |-
          apiVersion: v1
          kind: Template
          metadata:
            labels:
              app: enmasse
            name: topic-persisted
          objects:
          - apiVersion: v1
            kind: Service
            metadata:
              annotations:
                addressSpace: ${ADDRESS_SPACE}
                cluster_id: ${CLUSTER_ID}
              labels:
                app: enmasse
              name: ${NAME}
            spec:
              clusterIP: None
              selector:
                name: ${NAME}
                role: broker
          - apiVersion: apps/v1beta1
            kind: StatefulSet
            metadata:
              annotations:
                address: ${ADDRESS}
                addressSpace: ${ADDRESS_SPACE}
                cluster_id: ${CLUSTER_ID}
                enmasse.io/cert-cn: broker
                enmasse.io/cert-secret: broker-internal-cert
              labels:
                app: enmasse
              name: ${NAME}
            spec:
              replicas: 1
              serviceName: ${NAME}
              template:
                metadata:
                  annotations:
                    address: ${ADDRESS}
                    addressSpace: ${ADDRESS_SPACE}
                    cluster_id: ${CLUSTER_ID}
                    prometheus.io/path: /metrics
                    prometheus.io/port: '8080'
                    prometheus.io/scrape: 'true'
                  labels:
                    addresstype: topic
                    app: enmasse
                    name: ${NAME}
                    role: broker
                spec:
                  containers:
                  - env:
                    - name: TOPIC_NAME
                      value: ${ADDRESS}
                    - name: CLUSTER_ID
                      value: ${CLUSTER_ID}
                    - name: CERT_DIR
                      value: /etc/enmasse-certs
                    - name: GLOBAL_MAX_SIZE
                      value: ${GLOBAL_MAX_SIZE}
                    - name: AUTHENTICATION_SERVICE_HOST
                      value: ${AUTHENTICATION_SERVICE_HOST}
                    - name: AUTHENTICATION_SERVICE_PORT
                      value: ${AUTHENTICATION_SERVICE_PORT}
                    - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                      value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
                    - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                      value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
                    - name: AUTHENTICATION_SERVICE_OAUTH_URL
                      value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
                    image: docker.io/enmasseproject/artemis:latest
                    lifecycle:
                      preStop:
                        exec:
                          command:
                          - /shutdown-hook/shutdown-hook.sh
                    livenessProbe:
                      exec:
                        command:
                        - sh
                        - -c
                        - $ARTEMIS_HOME/bin/probe.sh
                      initialDelaySeconds: 120
                    name: broker
                    ports:
                    - containerPort: 5673
                      name: amqp
                    - containerPort: 8161
                      name: jolokia
                    - containerPort: 8080
                      name: artemismetrics
                    readinessProbe:
                      exec:
                        command:
                        - sh
                        - -c
                        - $ARTEMIS_HOME/bin/probe.sh
                      initialDelaySeconds: 10
                    resources:
                      limits:
                        memory: ${BROKER_MEMORY_LIMIT}
                      requests:
                        memory: ${BROKER_MEMORY_LIMIT}
                    volumeMounts:
                    - mountPath: /var/run/artemis
                      name: ${NAME}
                      readOnly: false
                    - mountPath: /etc/enmasse-certs
                      name: broker-internal-cert
                      readOnly: true
                    - mountPath: /etc/authservice-ca
                      name: authservice-ca
                      readOnly: true
                    - mountPath: /etc/prometheus-config
                      name: broker-prometheus-config
                      readOnly: true
                  - env:
                    - name: TOPIC_NAME
                      value: ${ADDRESS}
                    - name: LINK_CAPACITY
                      value: ${ROUTER_LINK_CAPACITY}
                    - name: ALLOW_DURABLE_SUBSCRIPTIONS
                      value: ${ALLOW_DURABLE_SUBSCRIPTIONS}
                    - name: AUTHENTICATION_SERVICE_HOST
                      value: ${AUTHENTICATION_SERVICE_HOST}
                    - name: AUTHENTICATION_SERVICE_PORT
                      value: ${AUTHENTICATION_SERVICE_PORT}
                    - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                      value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
                    - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                      value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
                    - name: AUTHENTICATION_SERVICE_OAUTH_URL
                      value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
                    image: docker.io/enmasseproject/router:latest
                    livenessProbe:
                      initialDelaySeconds: 60
                      tcpSocket:
                        port: amqp
                    name: router
                    ports:
                    - containerPort: 5672
                      name: amqp
                      protocol: TCP
                    - containerPort: 5671
                      name: amqps
                      protocol: TCP
                    - containerPort: 55671
                      name: amqps-normal
                      protocol: TCP
                    - containerPort: 56671
                      name: amqps-broker
                      protocol: TCP
                    resources:
                      limits:
                        memory: 256Mi
                      requests:
                        memory: 256Mi
                    volumeMounts:
                    - mountPath: /etc/qpid-dispatch/ssl
                      name: ssl-certs
                      readOnly: true
                    - mountPath: /etc/qpid-dispatch/authservice-ca
                      name: authservice-ca
                      readOnly: true
                    - mountPath: /etc/enmasse-certs
                      name: broker-internal-cert
                      readOnly: true
                  - env:
                    - name: TOPIC_NAME
                      value: ${ADDRESS}
                    - name: CLUSTER_ID
                      value: ${NAME}
                    - name: CERT_DIR
                      value: /etc/enmasse-certs
                    image: docker.io/enmasseproject/topic-forwarder:latest
                    livenessProbe:
                      httpGet:
                        path: /health
                        port: health
                      initialDelaySeconds: 60
                    name: forwarder
                    ports:
                    - containerPort: 8088
                      name: health
                    resources:
                      limits:
                        memory: 128Mi
                      requests:
                        memory: 128Mi
                    volumeMounts:
                    - mountPath: /etc/enmasse-certs
                      name: broker-internal-cert
                      readOnly: true
                  volumes:
                  - name: ssl-certs
                    secret:
                      secretName: ${COLOCATED_ROUTER_SECRET}
                  - name: authservice-ca
                    secret:
                      secretName: authservice-ca
                  - name: broker-internal-cert
                    secret:
                      secretName: broker-internal-cert
                  - configMap:
                      name: broker-prometheus-config
                    name: broker-prometheus-config
              volumeClaimTemplates:
              - apiVersion: v1
                kind: PersistentVolumeClaim
                metadata:
                  annotations:
                    addressSpace: ${ADDRESS_SPACE}
                    cluster_id: ${CLUSTER_ID}
                  labels:
                    app: enmasse
                  name: ${NAME}
                spec:
                  accessModes:
                  - ReadWriteOnce
                  resources:
                    requests:
                      storage: ${STORAGE_CAPACITY}
          parameters:
          - description: Storage capacity required for volume claims
            name: STORAGE_CAPACITY
            value: 2Gi
          - description: The link capacity setting for router
            name: ROUTER_LINK_CAPACITY
            value: '50'
          - description: A valid addressSpace name for the address Space
            name: ADDRESS_SPACE
            required: true
          - description: A valid name for the deployment
            name: NAME
            required: true
          - description: A valid group id for the deployment
            name: CLUSTER_ID
            required: true
          - description: The address to use for the topic
            name: ADDRESS
            value: ''
          - description: Name of secret containing router key and certificate
            name: COLOCATED_ROUTER_SECRET
            required: true
          - description: The hostname of the authentication service used by this address
              space
            name: AUTHENTICATION_SERVICE_HOST
            required: true
          - description: The port of the authentication service used by this address space
            name: AUTHENTICATION_SERVICE_PORT
            required: true
          - description: The secret to use for validating authentication service cert
            name: AUTHENTICATION_SERVICE_CA_SECRET
            required: true
          - description: The client cert to use as identity against authentication service
            name: AUTHENTICATION_SERVICE_CLIENT_SECRET
          - description: The hostname to use in sasl init
            name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
          - description: Memory limits for container
            name: BROKER_MEMORY_LIMIT
            value: 512Mi
          - description: Global max size for all addresses in broker. Cannot be larger than
              a quarter of BROKER_MEMORY_LIMIT
            name: GLOBAL_MAX_SIZE
            value: 128Mb
    - apiVersion: extensions/v1beta1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-secret: subserv-internal-cert
        labels:
          app: enmasse
          name: subserv
        name: subserv
      spec:
        replicas: 1
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              name: subserv
          spec:
            containers:
            - command:
              - node
              - /opt/app-root/src/bin/subserv.js
              image: docker.io/enmasseproject/agent:latest
              livenessProbe:
                initialDelaySeconds: 60
                tcpSocket:
                  port: amqp
              name: subserv
              ports:
              - containerPort: 5672
                name: amqp
                protocol: TCP
              resources:
                limits:
                  memory: 128Mi
                requests:
                  memory: 128Mi
              volumeMounts:
              - mountPath: /etc/enmasse-certs
                name: subserv-internal-cert
                readOnly: true
            volumes:
            - name: subserv-internal-cert
              secret:
                secretName: subserv-internal-cert
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/service-port.mqtt: 1883
          enmasse.io/service-port.mqtts: 8883
          io.enmasse.endpointPort: secure-mqtt
        labels:
          app: enmasse
        name: mqtt
      spec:
        ports:
        - name: mqtt
          port: 1883
          protocol: TCP
          targetPort: 1883
        - name: secure-mqtt
          port: 8883
          protocol: TCP
          targetPort: 8883
        selector:
          name: mqtt-gateway
        type: ClusterIP
    - apiVersion: extensions/v1beta1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
          name: mqtt-gateway
        name: mqtt-gateway
      spec:
        replicas: 1
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              name: mqtt-gateway
          spec:
            containers:
            - env:
              - name: ENMASSE_MQTT_SSL
                value: 'true'
              - name: ENMASSE_MQTT_KEYFILE
                value: /etc/mqtt-gateway/ssl/tls.key
              - name: ENMASSE_MQTT_CERTFILE
                value: /etc/mqtt-gateway/ssl/tls.crt
              - name: ENMASSE_MQTT_LISTENPORT
                value: '8883'
              - name: ENMASSE_MQTT_MAXMESSAGESIZE
                value: ${MQTT_MAXMESSAGESIZE}
              image: docker.io/enmasseproject/mqtt-gateway:latest
              livenessProbe:
                initialDelaySeconds: 60
                tcpSocket:
                  port: secure-mqtt
              name: mqtt-gateway-tls
              ports:
              - containerPort: 8883
                name: secure-mqtt
                protocol: TCP
              volumeMounts:
              - mountPath: /etc/mqtt-gateway/ssl
                name: ssl-certs
                readOnly: true
            - image: docker.io/enmasseproject/mqtt-gateway:latest
              livenessProbe:
                initialDelaySeconds: 60
                tcpSocket:
                  port: mqtt
              name: mqtt-gateway
              ports:
              - containerPort: 1883
                name: mqtt
                protocol: TCP
            volumes:
            - name: ssl-certs
              secret:
                secretName: ${MQTT_SECRET}
    - apiVersion: extensions/v1beta1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-secret: mqtt-lwt-internal-cert
        labels:
          app: enmasse
          name: mqtt-lwt
        name: mqtt-lwt
      spec:
        replicas: 1
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              name: mqtt-lwt
          spec:
            containers:
            - env:
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: MESSAGING_SERVICE_NORMAL_PORT
                value: $(MESSAGING_SERVICE_PORT_AMQPS_NORMAL)
              - name: MESSAGING_SERVICE_ROUTE_CONTAINER_PORT
                value: $(MESSAGING_SERVICE_PORT_AMQPS_BROKER)
              image: docker.io/enmasseproject/mqtt-lwt:latest
              name: mqtt-lwt
              volumeMounts:
              - mountPath: /etc/enmasse-certs
                name: mqtt-lwt-internal-cert
                readOnly: true
            volumes:
            - name: mqtt-lwt-internal-cert
              secret:
                secretName: mqtt-lwt-internal-cert
    parameters:
    - description: The link capacity setting for router
      name: ROUTER_LINK_CAPACITY
      value: '50'
    - description: Whether AMQP based durable subscriptions to topics are allowed
      name: ALLOW_DURABLE_SUBSCRIPTIONS
      value: 'true'
    - description: The hostname to use for the exposed route for messaging
      name: MESSAGING_HOSTNAME
    - description: The hostname to use for the exposed route for MQTT
      name: MQTT_GATEWAY_HOSTNAME
    - description: The hostname to use for the exposed route for the messaging console
      name: CONSOLE_HOSTNAME
    - description: The secret with cert for the console
      name: CONSOLE_SECRET
      required: true
    - description: The secret with cert for the messaging service
      name: MESSAGING_SECRET
      required: true
    - description: The secret to mount for MQTT private key and certificate
      name: MQTT_SECRET
      required: true
    - description: The name of our address space
      name: ADDRESS_SPACE
      required: true
    - description: The namespace of our address space
      name: ADDRESS_SPACE_NAMESPACE
      required: true
    - description: The hostname of the authentication service used by this address space
      name: AUTHENTICATION_SERVICE_HOST
      required: true
    - description: The port of the authentication service used by this address space
      name: AUTHENTICATION_SERVICE_PORT
      required: true
    - description: The CA cert to use for validating authentication service cert
      name: AUTHENTICATION_SERVICE_CA_CERT
      required: true
    - description: The client cert to use as identity against authentication service
      name: AUTHENTICATION_SERVICE_CLIENT_SECRET
    - description: The hostname to use in sasl init
      name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
    - description: The URL to use for OAUTH (if not set, OAUTH is not used)
      name: AUTHENTICATION_SERVICE_OAUTH_URL
    - description: Enable logging of kubernetes events
      name: ENABLE_EVENT_LOGGER
      value: 'false'
    - description: Interval (in seconds) to use between controller resync
      name: CONTROLLER_RESYNC_INTERVAL
      value: '600'
    - description: Interval (in seconds) to use between status checks
      name: CONTROLLER_CHECK_INTERVAL
      value: '30'
    - description: Max number of events queued up for controller
      name: CONTROLLER_EVENT_QUEUE_SIZE
      value: '10000'
    - description: The service account with address space admin privileges
      name: ADDRESS_SPACE_ADMIN_SA
      value: address-space-admin
    - description: Maximum message size allowed by the MQTT Gateway
      name: MQTT_MAXMESSAGESIZE
      value: '131072'
  brokered-space-infra.yaml: |-
    apiVersion: v1
    kind: Template
    metadata:
      labels:
        app: enmasse
      name: brokered-space-infra
    objects:
    - apiVersion: v1
      data:
        tls.crt: ${AUTHENTICATION_SERVICE_CA_CERT}
      kind: Secret
      metadata:
        name: authservice-ca
    - apiVersion: v1
      data:
        config.yaml: '{"hostPort": "127.0.0.1:1099", "rules": [{"labels": {"broker":
          "$1"}, "name": "artemis_connection_count", "pattern": "org.apache.activemq.artemis<broker=\"(.+)\"><>ConnectionCount",
          "type": "GAUGE"}, {"labels": {"address": "$2", "broker": "$1"}, "name": "artemis_consumer_count",
          "pattern": "org.apache.activemq.artemis<broker=\"(.+)\", component=addresses,
          address=\"(.+)\".*><>ConsumerCount", "type": "GAUGE"}, {"labels": {"address":
          "$2", "broker": "$1"}, "name": "artemis_message_count", "pattern": "org.apache.activemq.artemis<broker=\"(.+)\",
          component=addresses, address=\"(.+)\".*><>MessageCount", "type": "GAUGE"}],
          "ssl": true}'
      kind: ConfigMap
      metadata:
        name: broker-prometheus-config
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
        name: broker-data
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: ${STORAGE_CAPACITY}
    - apiVersion: extensions/v1beta1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-secret: broker-internal-cert
        labels:
          app: enmasse
          role: broker
        name: broker
      spec:
        replicas: 1
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
              prometheus.io/path: /metrics
              prometheus.io/port: '8080'
              prometheus.io/scrape: 'true'
            labels:
              app: enmasse
              name: broker
              role: broker
          spec:
            containers:
            - env:
              - name: ADDRESS_SPACE_TYPE
                value: brokered
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: AUTHENTICATION_SERVICE_OAUTH_URL
                value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
              image: docker.io/enmasseproject/artemis:latest
              livenessProbe:
                exec:
                  command:
                  - sh
                  - -c
                  - $ARTEMIS_HOME/bin/probe.sh
                initialDelaySeconds: 120
              name: broker
              ports:
              - containerPort: 5672
                name: amqp
              - containerPort: 5671
                name: amqps
              - containerPort: 55671
                name: amqps-normal
              - containerPort: 8161
                name: jolokia
              - containerPort: 8080
                name: artemismetrics
              readinessProbe:
                exec:
                  command:
                  - sh
                  - -c
                  - $ARTEMIS_HOME/bin/probe.sh
                initialDelaySeconds: 10
              volumeMounts:
              - mountPath: /var/run/artemis
                name: data
                readOnly: false
              - mountPath: /etc/enmasse-certs
                name: broker-internal-cert
                readOnly: true
              - mountPath: /etc/external-certs
                name: external-cert
                readOnly: true
              - mountPath: /etc/authservice-ca
                name: authservice-ca
                readOnly: true
              - mountPath: /etc/prometheus-config
                name: broker-prometheus-config
                readOnly: true
            volumes:
            - name: data
              persistentVolumeClaim:
                claimName: broker-data
            - configMap:
                name: broker-prometheus-config
              name: broker-prometheus-config
            - name: broker-internal-cert
              secret:
                secretName: broker-internal-cert
            - name: authservice-ca
              secret:
                secretName: authservice-ca
            - name: external-cert
              secret:
                secretName: ${MESSAGING_SECRET}
    - apiVersion: v1
      kind: Service
      metadata:
        labels:
          app: enmasse
        name: broker
      spec:
        ports:
        - name: amqps-normal
          port: 55671
          targetPort: amqps-normal
        selector:
          role: broker
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          io.enmasse.endpointPort: amqps
        labels:
          app: enmasse
        name: messaging
      spec:
        ports:
        - name: amqp
          port: 5672
          targetPort: amqp
        - name: amqps
          port: 5671
          targetPort: amqps
        selector:
          role: broker
    - apiVersion: extensions/v1beta1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-secret: agent-internal-cert
        labels:
          app: enmasse
          role: agent
        name: agent
      spec:
        replicas: 1
        strategy:
          type: Recreate
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              name: agent
              role: agent
          spec:
            containers:
            - env:
              - name: ADDRESS_SPACE
                value: ${ADDRESS_SPACE}
              - name: ADDRESS_SPACE_NAMESPACE
                value: ${ADDRESS_SPACE_NAMESPACE}
              - name: ENABLE_EVENT_LOGGER
                value: ${ENABLE_EVENT_LOGGER}
              - name: ADDRESS_SPACE_TYPE
                value: brokered
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: CONSOLE_CERT_DIR
                value: /etc/console-certs
              - name: MESSAGING_CERT
                value: /opt/agent/messaging-cert/tls.crt
              - name: PROBE_PORT
                value: '8088'
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: AUTHENTICATION_SERVICE_OAUTH_URL
                value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
              image: docker.io/enmasseproject/agent:latest
              livenessProbe:
                httpGet:
                  path: /probe
                  port: http
                  scheme: HTTP
              name: agent
              ports:
              - containerPort: 8080
                name: https
              - containerPort: 8088
                name: http
              readinessProbe:
                httpGet:
                  path: /probe
                  port: http
                  scheme: HTTP
              volumeMounts:
              - mountPath: /opt/agent/authservice-ca
                name: authservice-ca
                readOnly: true
              - mountPath: /etc/console-certs
                name: console-external-cert
                readOnly: true
              - mountPath: /etc/enmasse-certs
                name: agent-internal-cert
                readOnly: true
              - mountPath: /opt/agent/messaging-cert
                name: messaging-cert
                readOnly: true
            serviceAccount: ${ADDRESS_SPACE_ADMIN_SA}
            volumes:
            - name: authservice-ca
              secret:
                secretName: authservice-ca
            - name: console-external-cert
              secret:
                secretName: ${CONSOLE_SECRET}
            - name: agent-internal-cert
              secret:
                secretName: agent-internal-cert
            - name: messaging-cert
              secret:
                secretName: external-certs-messaging
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          io.enmasse.endpointPort: https
        labels:
          app: enmasse
        name: console
      spec:
        ports:
        - name: https
          port: 8081
          targetPort: 8080
        selector:
          role: agent
    parameters:
    - description: Storage capacity required for volume claims
      name: STORAGE_CAPACITY
      value: 2Gi
    - description: The name of our address space
      name: ADDRESS_SPACE
      required: true
    - description: The namespace of our address space
      name: ADDRESS_SPACE_NAMESPACE
      required: true
    - description: Certificate to be used for public messaging service
      name: MESSAGING_SECRET
      required: true
    - description: Certificate to be used for public console service
      name: CONSOLE_SECRET
      required: true
    - description: The hostname of the authentication service used by this address space
      name: AUTHENTICATION_SERVICE_HOST
      required: true
    - description: The port of the authentication service used by this address space
      name: AUTHENTICATION_SERVICE_PORT
      required: true
    - description: The CA cert to use for validating authentication service cert
      name: AUTHENTICATION_SERVICE_CA_CERT
      required: true
    - description: The client cert to use as identity against authentication service
      name: AUTHENTICATION_SERVICE_CLIENT_SECRET
    - description: The hostname to use in sasl init
      name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
    - description: The URL to use for OAUTH (if not set, OAUTH is not used)
      name: AUTHENTICATION_SERVICE_OAUTH_URL
    - description: Enable logging of kubernetes events
      name: ENABLE_EVENT_LOGGER
      value: 'false'
    - description: The service account with address space admin privileges
      name: ADDRESS_SPACE_ADMIN_SA
      value: address-space-admin
