apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app: enmasse
  name: address-space-definitions
data:
  standard-space-infra.yaml: |-
    apiVersion: v1
    kind: Template
    metadata:
      labels:
        app: enmasse
      name: standard-space-infra
    objects:
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/service-port.amqp: 5672
          enmasse.io/service-port.amqps: 5671
          enmasse.io/service-port.amqp-wss: 443
        labels:
          app: enmasse
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: messaging-${INFRA_UUID}
      spec:
        ports:
        - name: amqp
          port: 5672
          protocol: TCP
          targetPort: 5672
        - name: amqps
          port: 5671
          protocol: TCP
          targetPort: 5671
        - name: amqps-normal
          port: 55671
          protocol: TCP
          targetPort: amqps-normal
        - name: amqps-broker
          port: 56671
          protocol: TCP
          targetPort: amqps-broker
        - name: inter-router
          port: 55672
          protocol: TCP
          targetPort: 55672
        - name: https
          port: 443
          protocol: TCP
          targetPort: 8443
        selector:
          capability: router
          infraUuid: ${INFRA_UUID}
    - apiVersion: v1
      kind: ConfigMap
      metadata:
        name: qdrouterd-config.${INFRA_UUID}
        labels:
          app: enmasse
          infraType: standard
          infraUuid: ${INFRA_UUID}
      data:
        qdrouterd.conf: |-
          router {
            mode: interior
            id: ${HOSTNAME}
            defaultDistribution: unavailable
            allowResumableLinkRoute: false
          }

          sslProfile {
            name: auth_service_ssl
            certDb: /etc/qpid-dispatch/authservice-ca/tls.crt
          }

          authServicePlugin {
            name: auth_service
            authService: ${AUTHENTICATION_SERVICE_HOST}:${AUTHENTICATION_SERVICE_PORT}
            saslInitHostname: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
            authSslProfile: auth_service_ssl
          }

          listener {
            host: 127.0.0.1
            port: 7777
            authenticatePeer: no
          }

          listener {
            host: 0.0.0.0
            port: 5672
            saslPlugin: auth_service
            authenticatePeer: yes
            linkCapacity: ${ROUTER_LINK_CAPACITY}
          }

          listener {
            host: 0.0.0.0
            port: 55672
            role: inter-router
            authenticatePeer: yes
            sslProfile: inter_router_tls
            saslMechanisms: EXTERNAL
            linkCapacity: ${ROUTER_LINK_CAPACITY}
          }

          listener {
            host: 0.0.0.0
            port: 8443
            saslPlugin: auth_service
            sslProfile: ssl_details
            http: true
            authenticatePeer: yes
            linkCapacity: ${ROUTER_LINK_CAPACITY}
          }

          sslProfile {
            name: ssl_details
            certFile: /etc/qpid-dispatch/ssl/tls.crt
            keyFile: /etc/qpid-dispatch/ssl/tls.key
          }

          listener {
            host: 0.0.0.0
            port: 5671
            saslPlugin: auth_service
            sslProfile: ssl_details
            requireSsl: true
            authenticatePeer: yes
            linkCapacity: ${ROUTER_LINK_CAPACITY}
          }

          sslProfile {
            name: inter_router_tls
            certFile: /etc/enmasse-certs/tls.crt
            keyFile: /etc/enmasse-certs/tls.key
            certDb: /etc/enmasse-certs/ca.crt
          }

          listener {
            host: 0.0.0.0
            port: 55671
            sslProfile: inter_router_tls
            saslMechanisms: EXTERNAL
            authenticatePeer: yes
            linkCapacity: ${ROUTER_LINK_CAPACITY}
          }

          listener {
            host: 0.0.0.0
            port: 56671
            sslProfile: inter_router_tls
            saslMechanisms: EXTERNAL
            role: route-container
            authenticatePeer: yes
            linkCapacity: ${ROUTER_LINK_CAPACITY}
          }

          connector {
            host: ragent-${INFRA_UUID}
            port: 5671
            sslProfile: inter_router_tls
            verifyHostName: no
          }

          linkRoute {
            name: override.lwt_in
            prefix: $lwt
            direction: in
            containerId: lwt-service
          }

          linkRoute {
            name: override.lwt_out
            prefix: $lwt
            direction: out
            containerId: lwt-service
          }

          address {
            name: override.mqtt
            prefix: $mqtt
            distribution: balanced
          }

          address {
            name: override.subctrl
            prefix: $subctrl
            distribution: balanced
          }

          address {
            name: override.temp
            prefix: $temp
            distribution: balanced
          }
    - apiVersion: apps/v1
      kind: StatefulSet
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-cn: router.${INFRA_UUID}
          enmasse.io/cert-secret: router-internal-cert.${INFRA_UUID}
          prometheus.io/path: /metrics
          prometheus.io/port: '8080'
          prometheus.io/scrape: 'true'
        labels:
          app: enmasse
          name: qdrouterd
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: qdrouterd-${INFRA_UUID}
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 1
                preference:
                  matchExpressions:
                    - key: node-role.enmasse.io/operator-infra
                      operator: In
                      values:
                        - "true"
        serviceName: qdrouterd-headless-${INFRA_UUID}
        replicas: 1
        selector:
          matchLabels:
            app: enmasse
            capability: router
            name: qdrouterd
            infraType: standard
            infraUuid: ${INFRA_UUID}
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              capability: router
              name: qdrouterd
              infraType: standard
              infraUuid: ${INFRA_UUID}
          spec:
            containers:
            - env:
              - name: QDROUTERD_CONF
                value: "/etc/qpid-dispatch/config/qdrouterd.conf"
              - name: QDROUTERD_AUTO_MESH_DISCOVERY
                value: "INFER"
              - name: QDROUTERD_AUTO_MESH_SERVICE_NAME
                value: "qdrouterd-headless-${INFRA_UUID}"
              image: amq7/amq-interconnect:1.3
              imagePullPolicy: Always
              livenessProbe:
                initialDelaySeconds: 60
                tcpSocket:
                  port: amqp
              readinessProbe:
                initialDelaySeconds: 60
                tcpSocket:
                  port: amqps-probe
              name: router
              resources:
                limits:
                  memory: ${ROUTER_MEMORY_LIMIT}
                requests:
                  memory: ${ROUTER_MEMORY_LIMIT}
              ports:
              - containerPort: 5672
                name: amqp
                protocol: TCP
              - containerPort: 5671
                name: amqps
                protocol: TCP
              - containerPort: 8443
                name: https
                protocol: TCP
              - containerPort: 55671
                name: amqps-normal
                protocol: TCP
              - containerPort: 56671
                name: amqps-broker
                protocol: TCP
              - containerPort: 56711
                name: amqps-probe
                protocol: TCP
              volumeMounts:
              - mountPath: /etc/qpid-dispatch/ssl
                name: ssl-certs
                readOnly: true
              - mountPath: /etc/qpid-dispatch/authservice-ca
                name: authservice-ca
                readOnly: true
              - mountPath: /etc/enmasse-certs
                name: router-internal-cert
                readOnly: true
              - mountPath: /etc/qpid-dispatch/config
                name: qdrouterd-config
            volumes:
            - name: ssl-certs
              secret:
                secretName: ${MESSAGING_SECRET}
            - name: authservice-ca
              secret:
                secretName: authservice-ca.${INFRA_UUID}
            - name: router-internal-cert
              secret:
                secretName: router-internal-cert.${INFRA_UUID}
            - name: qdrouterd-config
              configMap:
                name: qdrouterd-config.${INFRA_UUID}
    - apiVersion: v1
      data:
        tls.crt: ${AUTHENTICATION_SERVICE_CA_CERT}
      kind: Secret
      metadata:
        name: authservice-ca.${INFRA_UUID}
        labels:
          app: enmasse
          infraType: standard
          infraUuid: ${INFRA_UUID}
    - apiVersion: apps/v1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-secret: admin-internal-cert.${INFRA_UUID}
        labels:
          app: enmasse
          name: admin
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: admin.${INFRA_UUID}
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 1
                preference:
                  matchExpressions:
                    - key: node-role.enmasse.io/operator-infra
                      operator: In
                      values:
                        - "true"
        replicas: 1
        strategy:
          type: Recreate
        selector:
          matchLabels:
            app: enmasse
            name: admin
            infraType: standard
            infraUuid: ${INFRA_UUID}
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              name: admin
              infraType: standard
              infraUuid: ${INFRA_UUID}
          spec:
            containers:
            - env:
              - name: MESSAGING_SERVICE_HOST
                value: messaging-${INFRA_UUID}
              - name: MESSAGING_SERVICE_PORT_AMQPS_NORMAL
                value: 55671
              - name: MESSAGING_SERVICE_PORT_AMQPS_BROKER
                value: 56671
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: TEMPLATE_DIR
                value: /broker-templates
              - name: STANDARD_INFRA_CONFIG_NAME
                value: ${STANDARD_INFRA_CONFIG_NAME}
              - name: ADDRESS_SPACE
                value: ${ADDRESS_SPACE}
              - name: ADDRESS_SPACE_NAMESPACE
                value: ${ADDRESS_SPACE_NAMESPACE}
              - name: INFRA_UUID
                value: ${INFRA_UUID}
              - name: ADDRESS_SPACE_PLAN
                value: ${ADDRESS_SPACE_PLAN}
              - name: RESYNC_INTERVAL
                value: ${CONTROLLER_RESYNC_INTERVAL}
              - name: CHECK_INTERVAL
                value: ${CONTROLLER_CHECK_INTERVAL}
              - name: EVENT_QUEUE_SIZE
                value: ${CONTROLLER_EVENT_QUEUE_SIZE}
              - name: ENABLE_EVENT_LOGGER
                value: ${ENABLE_EVENT_LOGGER}
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CA_SECRET
                value: authservice-ca
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: JAVA_OPTS
                value: -verbose:gc
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: MESSAGING_SECRET
                value: ${MESSAGING_SECRET}
              image: amq7/amq-online-1-standard-controller:dev
              imagePullPolicy: Always
              livenessProbe:
                httpGet:
                  path: /healthz
                  port: http
                  scheme: HTTP
                initialDelaySeconds: 30
              name: standard-controller
              ports:
              - containerPort: 8889
                name: http
              readinessProbe:
                httpGet:
                  path: /healthz
                  port: http
                  scheme: HTTP
                initialDelaySeconds: 30
              resources:
                limits:
                  memory: ${ADMIN_MEMORY_LIMIT}
                requests:
                  memory: ${ADMIN_MEMORY_LIMIT}
              volumeMounts:
              - mountPath: /etc/enmasse-certs
                name: admin-internal-cert
                readOnly: true
              - mountPath: /broker-templates
                name: broker-templates
                readOnly: true
            - env:
              - name: MESSAGING_SERVICE_HOST
                value: messaging-${INFRA_UUID}
              - name: MESSAGING_SERVICE_PORT_AMQPS_NORMAL
                value: 55671
              - name: MESSAGING_SERVICE_PORT_AMQPS_BROKER
                value: 56671
              - name: INFRA_UUID
                value: ${INFRA_UUID}
              - name: ADDRESS_SPACE_PLAN
                value: ${ADDRESS_SPACE_PLAN}
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CA_SECRET
                value: authservice-ca
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: AUTHENTICATION_SERVICE_OAUTH_URL
                value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
              - name: AUTHENTICATION_SERVICE_KC_IDP_HINT
                value: ${AUTHENTICATION_SERVICE_KC_IDP_HINT}
              - name: ADDRESS_SPACE
                value: ${ADDRESS_SPACE}
              - name: ADDRESS_SPACE_NAMESPACE
                value: ${ADDRESS_SPACE_NAMESPACE}
              - name: MESSAGING_CERT
                value: /opt/agent/messaging-cert/tls.crt
              image: amq7/amq-online-1-agent:dev
              imagePullPolicy: Always
              livenessProbe:
                httpGet:
                  path: /healthz
                  port: http
                  scheme: HTTP
                periodSeconds: 30
                timeoutSeconds: 5
              name: agent
              ports:
              - containerPort: 8888
                name: http
              - containerPort: 8080
                name: https
              - containerPort: 56720
                name: amqp-ws
              readinessProbe:
                httpGet:
                  path: /healthz
                  port: http
                  scheme: HTTP
                periodSeconds: 30
                timeoutSeconds: 5
              resources:
                limits:
                  memory: ${ADMIN_MEMORY_LIMIT}
                requests:
                  memory: ${ADMIN_MEMORY_LIMIT}
              volumeMounts:
              - mountPath: /etc/console-certs
                name: console-secret
                readOnly: true
              - mountPath: /opt/agent/authservice-ca
                name: authservice-ca
                readOnly: true
              - mountPath: /etc/enmasse-certs
                name: admin-internal-cert
                readOnly: true
              - mountPath: /opt/agent/messaging-cert
                name: messaging-cert
                readOnly: true
            serviceAccountName: ${ADDRESS_SPACE_ADMIN_SA}
            volumes:
            - name: console-secret
              secret:
                secretName: ${CONSOLE_SECRET}
            - name: authservice-ca
              secret:
                secretName: authservice-ca.${INFRA_UUID}
            - name: admin-internal-cert
              secret:
                secretName: admin-internal-cert.${INFRA_UUID}
            - name: messaging-cert
              secret:
                secretName: ${MESSAGING_SECRET}
            - name: broker-templates
              configMap:
                name: standard-broker-definitions
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: qdrouterd-headless-${INFRA_UUID}
      spec:
        clusterIP: None
        ports:
        - name: inter-router
          port: 55672
          targetPort: 55672
        selector:
          capability: router
          infraUuid: ${INFRA_UUID}
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: ragent-${INFRA_UUID}
      spec:
        ports:
        - name: amqp
          port: 5671
          targetPort: 55671
        selector:
          name: admin
          infraUuid: ${INFRA_UUID}
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: standard-controller-${INFRA_UUID}
      spec:
        ports:
        - name: health
          port: 8080
          protocol: TCP
          targetPort: 8889
        selector:
          name: admin
          infraUuid: ${INFRA_UUID}
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: queue-scheduler-${INFRA_UUID}
      spec:
        ports:
        - name: amqp
          port: 5672
          targetPort: 55671
        selector:
          name: admin
          infraUuid: ${INFRA_UUID}
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/service-port.https: 8081
        labels:
          app: enmasse
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: console-${INFRA_UUID}
      spec:
        ports:
        - name: https
          port: 8081
          targetPort: 8080
        selector:
          name: admin
          infraUuid: ${INFRA_UUID}
    parameters:
    - name: INFRA_UUID
      description: UUID to use for infrastructure
      required: true
    - name: INFRA_NAMESPACE
      description: Namespace where infrastructure is created
      required: true
    - name: ADDRESS_SPACE_PLAN
      description: Name of address space plan followed
      required: true
    - description: The link capacity setting for router
      name: ROUTER_LINK_CAPACITY
      value: '250'
    - description: The hostname to use for the exposed route for messaging
      name: CONSOLE_SECRET
      required: true
    - description: The secret with cert for the messaging service
      name: MESSAGING_SECRET
      required: true
    - description: The name of our address space
      name: ADDRESS_SPACE
      required: true
    - description: The namespace of our address space
      name: ADDRESS_SPACE_NAMESPACE
      required: true
    - description: The hostname of the authentication service used by this address space
      name: AUTHENTICATION_SERVICE_HOST
      required: true
    - description: The port of the authentication service used by this address space
      name: AUTHENTICATION_SERVICE_PORT
      required: true
    - description: The CA cert to use for validating authentication service cert
      name: AUTHENTICATION_SERVICE_CA_CERT
      required: true
    - description: The client cert to use as identity against authentication service
      name: AUTHENTICATION_SERVICE_CLIENT_SECRET
    - description: The hostname to use in sasl init
      name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
    - description: The URL to use for OAUTH (if not set, OAUTH is not used)
      name: AUTHENTICATION_SERVICE_OAUTH_URL
    - description: Name of Keycloak Identification Provider Hint
      name: AUTHENTICATION_SERVICE_KC_IDP_HINT
    - description: Name standard infra config
      name: STANDARD_INFRA_CONFIG_NAME
      required: true
    - description: Enable logging of kubernetes events
      name: ENABLE_EVENT_LOGGER
      value: 'false'
    - description: Interval (in seconds) to use between controller resync
      name: CONTROLLER_RESYNC_INTERVAL
      value: '600'
    - description: Interval (in seconds) to use between status checks
      name: CONTROLLER_CHECK_INTERVAL
      value: '30'
    - description: Max number of events queued up for controller
      name: CONTROLLER_EVENT_QUEUE_SIZE
      value: '10000'
    - description: The service account with address space admin privileges
      name: ADDRESS_SPACE_ADMIN_SA
      value: address-space-admin
    - description: Memory limits for admin
      name: ADMIN_MEMORY_LIMIT
      value: 512Mi
    - description: Memory limits for router
      name: ROUTER_MEMORY_LIMIT
      value: 512Mi
  standard-space-infra-mqtt.yaml: |-
    apiVersion: v1
    kind: Template
    metadata:
      labels:
        app: enmasse
      name: standard-space-infra-mqtt
    objects:
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: subscription-${INFRA_UUID}
      spec:
        ports:
        - name: amqp
          port: 5672
          protocol: TCP
          targetPort: 5672
        selector:
          name: subserv
          infraUuid: ${INFRA_UUID}
    - apiVersion: apps/v1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-secret: subserv-internal-cert.${INFRA_UUID}
        labels:
          app: enmasse
          name: subserv
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: subserv.${INFRA_UUID}
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 1
                preference:
                  matchExpressions:
                    - key: node-role.enmasse.io/messaging-infra
                      operator: In
                      values:
                        - "true"
        replicas: 1
        selector:
          matchLabels:
            app: enmasse
            name: subserv
            infraType: standard
            infraUuid: ${INFRA_UUID}
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              name: subserv
              infraType: standard
              infraUuid: ${INFRA_UUID}
          spec:
            containers:
            - env:
              - name: MESSAGING_SERVICE_HOST
                value: messaging-${INFRA_UUID}
              - name: MESSAGING_SERVICE_PORT_AMQPS_NORMAL
                value: 55671
              - name: MESSAGING_SERVICE_PORT_AMQPS_BROKER
                value: 56671
              command:
              - /opt/app-root/src/bin/launch_node.sh
              - /opt/app-root/src/bin/subserv.js
              image: amq7/amq-online-1-agent:dev
              imagePullPolicy: Always
              livenessProbe:
                initialDelaySeconds: 60
                tcpSocket:
                  port: amqp
              name: subserv
              ports:
              - containerPort: 5672
                name: amqp
                protocol: TCP
              resources:
                limits:
                  memory: 128Mi
                requests:
                  memory: 128Mi
              volumeMounts:
              - mountPath: /etc/enmasse-certs
                name: subserv-internal-cert
                readOnly: true
            volumes:
            - name: subserv-internal-cert
              secret:
                secretName: subserv-internal-cert.${INFRA_UUID}
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/service-port.mqtt: 1883
          enmasse.io/service-port.mqtts: 8883
        labels:
          app: enmasse
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: mqtt-${INFRA_UUID}
      spec:
        ports:
        - name: mqtt
          port: 1883
          protocol: TCP
          targetPort: 1883
        - name: secure-mqtt
          port: 8883
          protocol: TCP
          targetPort: 8883
        selector:
          name: mqtt-gateway
          infraUuid: ${INFRA_UUID}
        type: ClusterIP
    - apiVersion: apps/v1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
          name: mqtt-gateway
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: mqtt-gateway.${INFRA_UUID}
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 1
                preference:
                  matchExpressions:
                    - key: node-role.enmasse.io/messaging-infra
                      operator: In
                      values:
                        - "true"
        replicas: 1
        selector:
          matchLabels:
            app: enmasse
            name: mqtt-gateway
            infraType: standard
            infraUuid: ${INFRA_UUID}
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              name: mqtt-gateway
              infraType: standard
              infraUuid: ${INFRA_UUID}
          spec:
            containers:
            - env:
              - name: MESSAGING_SERVICE_HOST
                value: messaging-${INFRA_UUID}
              - name: MESSAGING_SERVICE_PORT
                value: 5672
              - name: ENMASSE_MQTT_SSL
                value: 'true'
              - name: ENMASSE_MQTT_KEYFILE
                value: /etc/mqtt-gateway/ssl/tls.key
              - name: ENMASSE_MQTT_CERTFILE
                value: /etc/mqtt-gateway/ssl/tls.crt
              - name: ENMASSE_MQTT_LISTENPORT
                value: '8883'
              - name: ENMASSE_MQTT_MAXMESSAGESIZE
                value: ${MQTT_MAXMESSAGESIZE}
              image: amq7/amq-online-1-mqtt-gateway:dev
              imagePullPolicy: Always
              livenessProbe:
                initialDelaySeconds: 60
                tcpSocket:
                  port: secure-mqtt
              name: mqtt-gateway-tls
              ports:
              - containerPort: 8883
                name: secure-mqtt
                protocol: TCP
              volumeMounts:
              - mountPath: /etc/mqtt-gateway/ssl
                name: ssl-certs
                readOnly: true
            - image: amq7/amq-online-1-mqtt-gateway:dev
              imagePullPolicy: Always
              env:
              - name: MESSAGING_SERVICE_HOST
                value: messaging-${INFRA_UUID}
              - name: MESSAGING_SERVICE_PORT
                value: 5672
              livenessProbe:
                initialDelaySeconds: 60
                tcpSocket:
                  port: mqtt
              name: mqtt-gateway
              ports:
              - containerPort: 1883
                name: mqtt
                protocol: TCP
            volumes:
            - name: ssl-certs
              secret:
                secretName: ${MQTT_SECRET}
    - apiVersion: apps/v1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-secret: mqtt-lwt-internal-cert.${INFRA_UUID}
        labels:
          app: enmasse
          name: mqtt-lwt
          infraType: standard
          infraUuid: ${INFRA_UUID}
        name: mqtt-lwt.${INFRA_UUID}
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 1
                preference:
                  matchExpressions:
                    - key: node-role.enmasse.io/messaging-infra
                      operator: In
                      values:
                        - "true"
        replicas: 1
        selector:
          matchLabels:
            app: enmasse
            name: mqtt-lwt
            infraType: standard
            infraUuid: ${INFRA_UUID}
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
            labels:
              app: enmasse
              name: mqtt-lwt
              infraType: standard
              infraUuid: ${INFRA_UUID}
          spec:
            containers:
            - env:
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: MESSAGING_SERVICE_HOST
                value: messaging-${INFRA_UUID}
              - name: MESSAGING_SERVICE_NORMAL_PORT
                value: 55671
              - name: MESSAGING_SERVICE_ROUTE_CONTAINER_PORT
                value: 56671
              image: amq7/amq-online-1-mqtt-lwt:dev
              imagePullPolicy: Always
              name: mqtt-lwt
              volumeMounts:
              - mountPath: /etc/enmasse-certs
                name: mqtt-lwt-internal-cert
                readOnly: true
            volumes:
            - name: mqtt-lwt-internal-cert
              secret:
                secretName: mqtt-lwt-internal-cert.${INFRA_UUID}
    parameters:
    - name: INFRA_UUID
      description: UUID to use for infrastructure
      required: true
    - description: The name of our address space
      name: ADDRESS_SPACE
      required: true
    - description: Maximum message size allowed by the MQTT Gateway
      name: MQTT_MAXMESSAGESIZE
      value: '131072'
    - description: The secret with cert for the mqtt service
      name: MQTT_SECRET
      required: true
  brokered-space-infra.yaml: |-
    apiVersion: v1
    kind: Template
    metadata:
      labels:
        app: enmasse
      name: brokered-space-infra
    objects:
    - apiVersion: v1
      data:
        tls.crt: ${AUTHENTICATION_SERVICE_CA_CERT}
      kind: Secret
      metadata:
        name: authservice-ca.${INFRA_UUID}
        labels:
          app: enmasse
          infraUuid: ${INFRA_UUID}
          infraType: brokered
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
        labels:
          app: enmasse
          infraType: brokered
          infraUuid: ${INFRA_UUID}
        name: broker-data.${INFRA_UUID}
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: ${BROKER_STORAGE_CAPACITY}
    - apiVersion: apps/v1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-secret: broker-internal-cert.${INFRA_UUID}
        labels:
          app: enmasse
          role: broker
          infraType: brokered
          infraUuid: ${INFRA_UUID}
        name: broker.${INFRA_UUID}
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 1
                preference:
                  matchExpressions:
                    - key: node-role.enmasse.io/messaging-infra
                      operator: In
                      values:
                        - "true"
        replicas: 1
        strategy:
          type: Recreate
        selector:
          matchLabels:
            app: enmasse
            name: broker
            role: broker
            infraUuid: ${INFRA_UUID}
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
              prometheus.io/path: /metrics
              prometheus.io/port: '8080'
              prometheus.io/scrape: 'true'
            labels:
              app: enmasse
              name: broker
              role: broker
              infraUuid: ${INFRA_UUID}
          spec:
            containers:
            - env:
              - name: INFRA_UUID
                value: ${INFRA_UUID}
              - name: ADDRESS_SPACE_TYPE
                value: brokered
              - name: ADDRESS_FULL_POLICY
                value: ${BROKER_ADDRESS_FULL_POLICY}
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: AUTHENTICATION_SERVICE_OAUTH_URL
                value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
              - name: AMQ_NAME
                value: broker
              image: amq-broker-7/amq-broker-72-openshift:latest
              imagePullPolicy: Always
              command:
              - /opt/amq/custom/bin/launch-broker.sh
              livenessProbe:
                exec:
                  command:
                  - sh
                  - -c
                  - $AMQ_HOME/custom/bin/probe.sh
                initialDelaySeconds: 120
              name: broker
              ports:
              - containerPort: 5672
                name: amqp
              - containerPort: 5671
                name: amqps
              - containerPort: 55671
                name: amqps-normal
              - containerPort: 8161
                name: jolokia
              - containerPort: 8080
                name: artemismetrics
              readinessProbe:
                exec:
                  command:
                  - sh
                  - -c
                  - $AMQ_HOME/custom/bin/probe.sh
                initialDelaySeconds: 10
              resources:
                limits:
                  memory: ${BROKER_MEMORY_LIMIT}
                requests:
                  memory: ${BROKER_MEMORY_LIMIT}
              volumeMounts:
              - mountPath: /var/run/artemis
                name: data
              - mountPath: /etc/prometheus-config
                name: broker-prometheus-config
                readOnly: true
              - mountPath: /opt/amq/custom
                name: broker-custom
                readOnly: false
            initContainers:
            - env:
              - name: INFRA_UUID
                value: ${INFRA_UUID}
              - name: ADDRESS_SPACE_TYPE
                value: brokered
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: ADDRESS_FULL_POLICY
                value: ${BROKER_ADDRESS_FULL_POLICY}
              - name: GLOBAL_MAX_SIZE
                value: ${GLOBAL_MAX_SIZE}
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: AUTHENTICATION_SERVICE_OAUTH_URL
                value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
              - name: AMQ_NAME
                value: broker
              image: amq7/amq-online-1-broker-plugin:dev
              imagePullPolicy: Always
              name: broker-plugin
              volumeMounts:
              - mountPath: /var/run/artemis
                name: data
              - mountPath: /etc/enmasse-certs
                name: broker-internal-cert
                readOnly: true
              - mountPath: /etc/external-certs
                name: external-cert
                readOnly: true
              - mountPath: /etc/authservice-ca
                name: authservice-ca
                readOnly: true
              - mountPath: /etc/prometheus-config
                name: broker-prometheus-config
                readOnly: true
              - mountPath: /opt/amq/custom
                name: broker-custom
                readOnly: false
            volumes:
            - name: data
              persistentVolumeClaim:
                claimName: broker-data.${INFRA_UUID}
            - emptyDir: {}
              name: broker-custom
            - name: broker-prometheus-config
              configMap:
                name: broker-prometheus-config
            - name: broker-internal-cert
              secret:
                secretName: broker-internal-cert.${INFRA_UUID}
            - name: authservice-ca
              secret:
                secretName: authservice-ca.${INFRA_UUID}
            - name: external-cert
              secret:
                secretName: ${MESSAGING_SECRET}
    - apiVersion: v1
      kind: Service
      metadata:
        labels:
          app: enmasse
          infraType: brokered
          infraUuid: ${INFRA_UUID}
        name: broker-${INFRA_UUID}
      spec:
        ports:
        - name: amqps-normal
          port: 55671
          targetPort: amqps-normal
        selector:
          role: broker
          infraUuid: ${INFRA_UUID}
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/service-port.amqp: 5672
          enmasse.io/service-port.amqps: 5671
        labels:
          app: enmasse
          infraType: brokered
          infraUuid: ${INFRA_UUID}
        name: messaging-${INFRA_UUID}
      spec:
        ports:
        - name: amqp
          port: 5672
          targetPort: amqp
        - name: amqps
          port: 5671
          targetPort: amqps
        selector:
          role: broker
          infraUuid: ${INFRA_UUID}
    - apiVersion: apps/v1
      kind: Deployment
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          enmasse.io/cert-secret: agent-internal-cert.${INFRA_UUID}
        labels:
          app: enmasse
          role: agent
          infraType: brokered
          infraUuid: ${INFRA_UUID}
        name: agent.${INFRA_UUID}
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 1
                preference:
                  matchExpressions:
                    - key: node-role.enmasse.io/operator-infra
                      operator: In
                      values:
                        - "true"
        replicas: 1
        strategy:
          type: Recreate
        selector:
          matchLabels:
            app: enmasse
            name: agent
            role: agent
            infraUuid: ${INFRA_UUID}
        template:
          metadata:
            annotations:
              addressSpace: ${ADDRESS_SPACE}
              namespace: ${ADDRESS_SPACE_NAMESPACE}
            labels:
              app: enmasse
              name: agent
              role: agent
              infraUuid: ${INFRA_UUID}
          spec:
            containers:
            - env:
              - name: BROKER_SERVICE_HOST
                value: broker-${INFRA_UUID}
              - name: BROKER_SERVICE_PORT
                value: 55671
              - name: ADDRESS_SPACE_PLAN
                value: ${ADDRESS_SPACE_PLAN}
              - name: ADDRESS_SPACE
                value: ${ADDRESS_SPACE}
              - name: ADDRESS_SPACE_NAMESPACE
                value: ${ADDRESS_SPACE_NAMESPACE}
              - name: INFRA_UUID
                value: ${INFRA_UUID}
              - name: ADDRESS_SPACE_TYPE
                value: brokered
              - name: ENABLE_EVENT_LOGGER
                value: ${ENABLE_EVENT_LOGGER}
              - name: ADDRESS_SPACE_TYPE
                value: brokered
              - name: CERT_DIR
                value: /etc/enmasse-certs
              - name: CONSOLE_CERT_DIR
                value: /etc/console-certs
              - name: MESSAGING_CERT
                value: /opt/agent/messaging-cert/tls.crt
              - name: HEALTH_PORT
                value: '8088'
              - name: AUTHENTICATION_SERVICE_HOST
                value: ${AUTHENTICATION_SERVICE_HOST}
              - name: AUTHENTICATION_SERVICE_PORT
                value: ${AUTHENTICATION_SERVICE_PORT}
              - name: AUTHENTICATION_SERVICE_CLIENT_SECRET
                value: ${AUTHENTICATION_SERVICE_CLIENT_SECRET}
              - name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
                value: ${AUTHENTICATION_SERVICE_SASL_INIT_HOST}
              - name: AUTHENTICATION_SERVICE_OAUTH_URL
                value: ${AUTHENTICATION_SERVICE_OAUTH_URL}
              - name: AUTHENTICATION_SERVICE_KC_IDP_HINT
                value: ${AUTHENTICATION_SERVICE_KC_IDP_HINT}
              image: amq7/amq-online-1-agent:dev
              imagePullPolicy: Always
              livenessProbe:
                httpGet:
                  path: /healthz
                  port: http
                  scheme: HTTP
              name: agent
              resources:
                limits:
                  memory: ${ADMIN_MEMORY_LIMIT}
                requests:
                  memory: ${ADMIN_MEMORY_LIMIT}
              ports:
              - containerPort: 8080
                name: https
              - containerPort: 8088
                name: http
              readinessProbe:
                httpGet:
                  path: /healthz
                  port: http
                  scheme: HTTP
              volumeMounts:
              - mountPath: /opt/agent/authservice-ca
                name: authservice-ca
                readOnly: true
              - mountPath: /etc/console-certs
                name: console-external-cert
                readOnly: true
              - mountPath: /etc/enmasse-certs
                name: agent-internal-cert
                readOnly: true
              - mountPath: /opt/agent/messaging-cert
                name: messaging-cert
                readOnly: true
            serviceAccountName: ${ADDRESS_SPACE_ADMIN_SA}
            volumes:
            - name: authservice-ca
              secret:
                secretName: authservice-ca.${INFRA_UUID}
            - name: console-external-cert
              secret:
                secretName: ${CONSOLE_SECRET}
            - name: agent-internal-cert
              secret:
                secretName: agent-internal-cert.${INFRA_UUID}
            - name: messaging-cert
              secret:
                secretName: ${MESSAGING_SECRET}
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          addressSpace: ${ADDRESS_SPACE}
          namespace: ${ADDRESS_SPACE_NAMESPACE}
          enmasse.io/service-port.https: 8081
        labels:
          app: enmasse
          infraType: brokered
          infraUuid: ${INFRA_UUID}
        name: console-${INFRA_UUID}
      spec:
        ports:
        - name: https
          port: 8081
          targetPort: 8080
        - name: health
          port: 8088
          targetPort: 8088
        selector:
          role: agent
          infraUuid: ${INFRA_UUID}

    parameters:
    - name: INFRA_UUID
      description: UUID to use for infrastructure
      required: true
    - name: INFRA_NAMESPACE
      description: Namespace where infrastructure is created
      required: true
    - description: Storage capacity required for volume claims
      name: BROKER_STORAGE_CAPACITY
      value: 2Gi
    - description: The name of our address space
      name: ADDRESS_SPACE
      required: true
    - description: The namespace of our address space
      name: ADDRESS_SPACE_NAMESPACE
      required: true
    - name: ADDRESS_SPACE_PLAN
      description: Name of address space plan followed
      required: true
    - description: Certificate to be used for public messaging service
      name: MESSAGING_SECRET
      required: true
    - description: Certificate to be used for public console service
      name: CONSOLE_SECRET
      required: true
    - description: The hostname of the authentication service used by this address space
      name: AUTHENTICATION_SERVICE_HOST
      required: true
    - description: The port of the authentication service used by this address space
      name: AUTHENTICATION_SERVICE_PORT
      required: true
    - description: The CA cert to use for validating authentication service cert
      name: AUTHENTICATION_SERVICE_CA_CERT
      required: true
    - description: The client cert to use as identity against authentication service
      name: AUTHENTICATION_SERVICE_CLIENT_SECRET
    - description: The hostname to use in sasl init
      name: AUTHENTICATION_SERVICE_SASL_INIT_HOST
    - description: The URL to use for OAUTH (if not set, OAUTH is not used)
      name: AUTHENTICATION_SERVICE_OAUTH_URL
    - description: Name of Keycloak Identification Provider Hint
      name: AUTHENTICATION_SERVICE_KC_IDP_HINT
    - description: Enable logging of kubernetes events
      name: ENABLE_EVENT_LOGGER
      value: 'false'
    - description: The service account with address space admin privileges
      name: ADDRESS_SPACE_ADMIN_SA
      value: address-space-admin
    - description: Memory limits for admin
      name: ADMIN_MEMORY_LIMIT
      value: 512Mi
    - description: Memory limits for container
      name: BROKER_MEMORY_LIMIT
      value: 512Mi
    - description: Global max size for all addresses in broker. Cannot be larger than
        a quarter of BROKER_MEMORY_LIMIT
      name: GLOBAL_MAX_SIZE
      value: "-1"
    - description: Broker address full policy
      name: BROKER_ADDRESS_FULL_POLICY
      value: FAIL
