apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app.kubernetes.io/instance: RELEASE-NAME
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: pipelines
    app.kubernetes.io/version: 1.19.4
    helm.sh/chart: pipelines-101.19.4
  name: RELEASE-NAME-pipelines-services
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: RELEASE-NAME
      app.kubernetes.io/name: pipelines
      component: RELEASE-NAME-pipelines-services
  serviceName: RELEASE-NAME-pipelines-services-headless
  template:
    metadata:
      annotations:
        checksum/configaws: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
        checksum/configfilebeat: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
        checksum/configk8s: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
        checksum/secretaws: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
        checksum/secretdb: 6321bfe9d4beed78234470975323bdbf4f435e6640cc74f5cf67ff063a4159d4
        checksum/secretk8s: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
        checksum/systemyaml: 01b3b02495ed1fd740bf4e6a89c431aa92ac361d0c759f2103d74c9991898c54
      labels:
        app.kubernetes.io/instance: RELEASE-NAME
        app.kubernetes.io/name: pipelines
        component: RELEASE-NAME-pipelines-services
    spec:
      containers:
      - env:
        - name: JF_ROUTER_SERVICEREGISTRY_URL
          value: http://RELEASE-NAME-artifactory:8082/access
        - name: JF_ROUTER_SERVICEREGISTRY_GRPCADDRESS
          value: ""
        - name: JF_ROUTER_ENTRYPOINTS_INTERNALPORT
          value: "8046"
        - name: JF_ROUTER_ENTRYPOINTS_EXTERNALPORT
          value: "8082"
        - name: JF_ROUTER_LOGGING_ROUTER_LOGLEVEL
          value: DEBUG
        - name: JF_SHARED_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: JF_SHARED_NODE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: JF_SHARED_SECURITY_JOINKEY
          value: EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
        - name: JF_ROUTER_ENCRYPTSYSTEMCONFIG
          value: "true"
        image: releases-docker.jfrog.io/jfrog/pipelines-router:1.19.4
        imagePullPolicy: IfNotPresent
        name: router
        ports:
        - containerPort: 8046
          name: http-router
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/router/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/router/var/log
          name: jfrog-pipelines-logs
        - mountPath: /var/opt/jfrog/router/data
          name: data-volume
      - env:
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-api:1.19.4
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 10
          httpGet:
            path: /
            port: http-api
          initialDelaySeconds: 0
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        name: api
        ports:
        - containerPort: 30000
          name: http-api
        readinessProbe:
          failureThreshold: 10
          httpGet:
            path: /
            port: http-api
          initialDelaySeconds: 0
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        startupProbe:
          failureThreshold: 60
          httpGet:
            path: /
            port: http-api
          initialDelaySeconds: 20
          periodSeconds: 5
          timeoutSeconds: 5
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
      - env:
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-www:1.19.4
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 10
          httpGet:
            path: /
            port: http-www
          initialDelaySeconds: 20
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 10
        name: www
        ports:
        - containerPort: 30001
          name: http-www
        readinessProbe:
          failureThreshold: 10
          httpGet:
            path: /
            port: http-www
          initialDelaySeconds: 20
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 10
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
      - env:
        - name: COMPONENT
          value: pipelinesync
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-micro:1.19.4
        imagePullPolicy: IfNotPresent
        name: pipelinesync
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
        workingDir: /opt/jfrog/pipelines/app/micro/pipelineSync
      - env:
        - name: COMPONENT
          value: runtrigger
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-micro:1.19.4
        imagePullPolicy: IfNotPresent
        name: runtrigger
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
        workingDir: /opt/jfrog/pipelines/app/micro/runTrigger
      - env:
        - name: COMPONENT
          value: steptrigger
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-micro:1.19.4
        imagePullPolicy: IfNotPresent
        name: steptrigger
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
        workingDir: /opt/jfrog/pipelines/app/micro/stepTrigger
      - env:
        - name: COMPONENT
          value: cron
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-micro:1.19.4
        imagePullPolicy: IfNotPresent
        name: cron
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
        workingDir: /opt/jfrog/pipelines/app/micro/cron
      - env:
        - name: COMPONENT
          value: nexec
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-micro:1.19.4
        imagePullPolicy: IfNotPresent
        name: nexec
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
        workingDir: /opt/jfrog/pipelines/app/micro/nexec
      - env:
        - name: COMPONENT
          value: hookhandler
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-micro:1.19.4
        imagePullPolicy: IfNotPresent
        name: hookhandler
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
        workingDir: /opt/jfrog/pipelines/app/micro/hookHandler
      - env:
        - name: COMPONENT
          value: marshaller
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-micro:1.19.4
        imagePullPolicy: IfNotPresent
        name: marshaller
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
        workingDir: /opt/jfrog/pipelines/app/micro/marshaller
      - env:
        - name: COMPONENT
          value: logup
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-micro:1.19.4
        imagePullPolicy: IfNotPresent
        name: logup
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
        workingDir: /opt/jfrog/pipelines/app/micro/logup
      - env:
        - name: COMPONENT
          value: extensionsync
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-micro:1.19.4
        imagePullPolicy: IfNotPresent
        name: extensionsync
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
        workingDir: /opt/jfrog/pipelines/app/micro/extensionSync
      - env:
        - name: COMPONENT
          value: reqsealer
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-micro:1.19.4
        imagePullPolicy: IfNotPresent
        name: reqsealer
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
        workingDir: /opt/jfrog/pipelines/app/micro/reqSealer
      - env:
        - name: COMPONENT
          value: templatesync
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-micro:1.19.4
        imagePullPolicy: IfNotPresent
        name: templatesync
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /opt/jfrog/pipelines/var/log
          name: jfrog-pipelines-logs
        workingDir: /opt/jfrog/pipelines/app/micro/templateSync
      initContainers:
      - command:
        - /bin/bash
        - -c
        - |
          until nc -z -w 5 RELEASE-NAME-artifactory 8082; do echo "Waiting for artifactory to start"; sleep 10; done; echo "Running init db scripts"; su postgres -c "bash /scripts/setupPostgres.sh"
        env:
        - name: PGUSERNAME
          value: postgres
        - name: DB_HOST
          value: RELEASE-NAME-postgresql
        - name: DB_PORT
          value: "5432"
        - name: DB_SSL_MODE
          value: disable
        - name: DB_NAME
          value: pipelinesdb
        - name: DB_USERNAME
          value: apiuser
        - name: DB_PASSWORD
          value: pipeline
        - name: PGPASSWORD
          value: postgres
        - name: CHART_NAME
          value: pipelines
        image: releases-docker.jfrog.io/postgres:13.4-alpine
        imagePullPolicy: Always
        name: postgres-setup-init
        securityContext:
          runAsUser: 0
        volumeMounts:
        - mountPath: /scripts
          name: postgres-setup-init-vol
      - command:
        - /bin/sh
        - -c
        - |
          echo "Copy system.yaml to /opt/jfrog/pipelines/var/etc"; cp -fv /tmp/etc/system.yaml /opt/jfrog/pipelines/var/etc/system.yaml;
        image: releases-docker.jfrog.io/alpine:3.14.2
        imagePullPolicy: IfNotPresent
        name: copy-system-yaml
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /tmp/etc/system.yaml
          name: systemyaml
          subPath: system.yaml
      - command:
        - sh
        - -c
        - |
          echo "Waiting for Postgres to come up..."; until nc -z -w 2 RELEASE-NAME-postgresql 5432 && echo database ok; do
            sleep 2;
          done; sleep 10;
        image: releases-docker.jfrog.io/alpine:3.14.2
        imagePullPolicy: IfNotPresent
        name: wait-for-db
        resources: {}
      - command:
        - sh
        - -c
        - |
          echo "Copy system.yaml to /opt/jfrog/pipelines/var/etc"; cp -fv /tmp/etc/system.yaml /opt/jfrog/pipelines/var/etc/system.yaml; echo "Creating Vault Table..."; ./pipelines-k8s initVault;
        env:
        - name: PIPELINES_SHARED_DB_CONNECTIONSTRING
          valueFrom:
            secretKeyRef:
              key: postgresql-url
              name: RELEASE-NAME-pipelines-database
        image: releases-docker.jfrog.io/jfrog/pipelines-installer:1.19.4
        imagePullPolicy: IfNotPresent
        name: create-vault-table
        resources: {}
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
        - mountPath: /tmp/etc/system.yaml
          name: systemyaml
          subPath: system.yaml
      - command:
        - sh
        - -c
        - |
          echo "Waiting for Vault to come up..."; until nc -z -w 2 RELEASE-NAME-vault 8200 && echo Vault ok; do
            sleep 2;
          done;
        image: releases-docker.jfrog.io/alpine:3.14.2
        imagePullPolicy: IfNotPresent
        name: wait-for-vault
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - NET_RAW
      - command:
        - sh
        - -c
        - |
          sleep 20; ./pipelines-k8s;
        env:
        - name: VAULT_TOKEN
          valueFrom:
            secretKeyRef:
              key: token
              name: root-vault-secret
        - name: PIPELINES_SHARED_DB_CONNECTIONSTRING
          valueFrom:
            secretKeyRef:
              key: postgresql-url
              name: RELEASE-NAME-pipelines-database
        - name: PIPELINES_NODE_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: releases-docker.jfrog.io/jfrog/pipelines-installer:1.19.4
        imagePullPolicy: IfNotPresent
        name: pipelines-installer
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - CHOWN
            drop:
            - NET_RAW
        volumeMounts:
        - mountPath: /opt/jfrog/pipelines/var/etc
          name: jfrog-pipelines-folder
      serviceAccountName: RELEASE-NAME-pipelines
      volumes:
      - configMap:
          name: RELEASE-NAME-setup-script
        name: postgres-setup-init-vol
      - emptyDir: {}
        name: jfrog-pipelines-folder
      - emptyDir: {}
        name: jfrog-pipelines-logs
      - emptyDir: {}
        name: data-volume
      - name: systemyaml
        secret:
          secretName: RELEASE-NAME-pipelines-system-yaml
  updateStrategy:
    type: RollingUpdate
