apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgresql
spec:
  serviceName: postgresql-headless
  replicas: 1
  selector:
    matchLabels:
      app: postgresql
  template:
    metadata:
      name: postgresql
      labels:
        app: postgresql
    spec:
      securityContext:
        runAsUser: 1001
        runAsGroup: 1001
        fsGroup: 1001
      containers:
        - name: postgresql
          image: postgres:13.1@sha256:839d6212e7aadb9612fd216374279b72f494c9c4ec517b8e98d768ac9dd74a15
          imagePullPolicy: IfNotPresent
          envFrom:
            - configMapRef:
                name: postgresql
            - secretRef:
                name: postgresql
          ports:
            - name: postgresql
              containerPort: 5432
          resources:
            requests:
              cpu: 500m
              memory: 512m
            limits:
              cpu: 1
              memory: 1G
          livenessProbe:
            exec:
              command:
                - /bin/sh
                - -c
                - -e
                - |
                  pg_isready -U $POSTGRES_USER -d $POSTGRES_DB -h 127.0.0.1 -p 5432
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 6
          readinessProbe:
            exec:
              command:
                - /bin/sh
                - -c
                - -e
                - |
                  pg_isready -U $POSTGRES_USER -d $POSTGRES_DB -h 127.0.0.1 -p 5432
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 6
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
            # Trick part 1 - This trick is to avoid to give containers write access to root filesystem
            - name: run
              mountPath: /var/run/postgresql
            # Trick part 2 - This trick is to avoid to give containers write access to root filesystem
            - name: tmp
              mountPath: /tmp
        - name: metrics
          # v0.8.0
          image: wrouesnel/postgres_exporter:v0.8.0@sha256:520fcd04d6c8f922d800d89ae96c021f4afd22e376c4b88260a8b780e3375dbe
          imagePullPolicy: IfNotPresent
          env:
            - name: DATA_SOURCE_URI
              value: 127.0.0.1:5432/ast?sslmode=disable
            - name: DATA_SOURCE_USER
              valueFrom:
                secretKeyRef:
                  name: postgresql
                  key: POSTGRES_USER
            - name: DATA_SOURCE_PASS
              valueFrom:
                secretKeyRef:
                  name: postgresql
                  key: POSTGRES_PASSWORD
          ports:
            - name: metrics
              containerPort: 9187
          resources:
            requests:
              cpu: 100m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 128Mi
          livenessProbe:
            httpGet:
              path: /
              port: metrics
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 6
          readinessProbe:
            httpGet:
              path: /
              port: metrics
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 6
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 500M
    # Trick part 2 - This trick is to avoid to give containers write access to root filesystem
    - metadata:
        name: run
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 500M
    # Trick part 2 - This trick is to avoid to give containers write access to root filesystem
    - metadata:
        name: tmp
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 500M
