# Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    component: elasticsearch
    role: client
  name: es-client
  namespace: elasticsearch
spec:
  replicas: 2
  selector:
    matchLabels:
      component: elasticsearch
      role: client
  template:
    metadata:
      labels:
        component: elasticsearch
        role: client
      annotations:
        iam.amazonaws.com/role: <ARN_OF_IAM_ROLE_FOR_CONTAINER>
    spec:
      serviceAccountName: elasticsearch
      # Add toleration for not scheduling on dedicated node
      tolerations:
      - key: dedicated
        value: "true"
        effect: NoSchedule
      # Weighted anti-affinity to disallow deploying client node to the same worker node as master node
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 1
              podAffinityTerm:
                topologyKey: "kubernetes.io/hostname"
                labelSelector:
                  matchLabels:
                    component: elasticsearch
                    role: client
        # Node Affinity to attract this Deployment's pods to a specific set of worker nodes
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: type # Replace this with corresponding worker node label's key
                operator: In
                values:
                - general # Replace this with corresponding worker node label's value
      initContainers:
      - name: init-sysctl
        image: busybox:1.27.2
        command:
        - sysctl
        - -w
        - vm.max_map_count=262144
        securityContext:
          privileged: true
      containers:
      - name: elasticsearch
        env:
        - name: CLUSTER_NAME
          value: logs
        - name: NUMBER_OF_MASTERS
          value: "3"
        - name: NODE_MASTER
          value: "false"
        - name: NODE_INGEST
          value: "true"
        - name: NODE_DATA
          value: "false"
        - name: TRANSPORT_TLS_PEM_PASS
          value: "REPLACE_WITH_TLS_PRIVATE_KEY_PASSPHRASE" # Replace this with the passphrase for the TLS private key
        - name: HTTP_TLS_PEM_PASS
          value: "REPLACE_WITH_TLS_PRIVATE_KEY_PASSPHRASE" # Replace this with the passphrase for the TLS private key
        - name: NETWORK_HOST
          value: "_eth0_"
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: DISCOVERY_SERVICE
          value: elasticsearch-discovery
        - name: KUBERNETES_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: PROCESSORS
          valueFrom:
            resourceFieldRef:
              resource: limits.cpu
        - name: ES_JAVA_OPTS
          value: -Xms6g -Xmx6g
        resources:
          requests:
            cpu: 2
            memory: 12Gi
          limits:
            cpu: 2
            memory: 12Gi
        # Official Image from Open Distro Team
        image: amazon/opendistro-for-elasticsearch:0.9.0
        imagePullPolicy: Always
        ports:
        - containerPort: 9200
          name: http
        - containerPort: 9300
          name: transport
        - containerPort: 9600
          name: metrics
        livenessProbe:
          tcpSocket:
            port: transport
          initialDelaySeconds: 60
        volumeMounts:
        - mountPath: /usr/share/elasticsearch/config/elasticsearch.yml
          name: config
          subPath: elasticsearch.yml
        - mountPath: /usr/share/elasticsearch/config/logging.yml
          name: config
          subPath: logging.yml
        - mountPath: /usr/share/elasticsearch/config/elk-crt.pem
          name: certs
          subPath: elk-crt.pem
          readOnly: true
        - mountPath: /usr/share/elasticsearch/config/elk-key.pem
          name: certs
          subPath: elk-key.pem
          readOnly: true
        - mountPath: /usr/share/elasticsearch/config/elk-root-ca.pem
          name: certs
          subPath: elk-root-ca.pem
          readOnly: true
        - mountPath: /usr/share/elasticsearch/config/admin-crt.pem
          name: certs
          subPath: admin-crt.pem
          readOnly: true
        - mountPath: /usr/share/elasticsearch/config/admin-key.pem
          name: certs
          subPath: admin-key.pem
          readOnly: true
        - mountPath: /usr/share/elasticsearch/config/admin-root-ca.pem
          name: certs
          subPath: admin-root-ca.pem
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: elasticsearch
      - name: certs
        secret:
          secretName: elasticsearch-tls-data
