apiVersion: apps/v1
kind: Deployment
metadata:
  name: etcd-quorum-guard
  namespace: openshift-machine-config-operator
  annotations:
    exclude.release.openshift.io/internal-openshift-hosted: "true"
spec:
  replicas: 3
  selector:
    matchLabels:
      k8s-app: etcd-quorum-guard
  strategy:
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        name: etcd-quorum-guard
        k8s-app: etcd-quorum-guard
    spec:
      hostNetwork: true
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: k8s-app
                operator: In
                values:
                - "etcd-quorum-guard"
            topologyKey: kubernetes.io/hostname
      nodeSelector:
        node-role.kubernetes.io/master: ""
      priorityClassName: "system-cluster-critical"
      terminationGracePeriodSeconds: 3
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
        operator: Exists
      - key: node.kubernetes.io/not-ready
        effect: NoExecute
        operator: Exists
        tolerationSeconds: 120
      - key: node.kubernetes.io/unreachable
        effect: NoExecute
        operator: Exists
        tolerationSeconds: 120
      - key: node-role.kubernetes.io/etcd
        operator: Exists
        effect: NoSchedule
      containers:
      - name: guard
        image: quay.io/openshift/origin-cli:latest
        imagePullPolicy: IfNotPresent
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /mnt/kube
          name: kubecerts
        command:
        - /bin/bash
        args:
        - -c
        - |
          # properly handle TERM and exit as soon as it is signaled
          set -euo pipefail
          trap 'jobs -p | xargs -r kill; exit 0' TERM
          sleep infinity & wait
        readinessProbe:
          exec:
            command:
            - /bin/sh
            - -c
            - |
                declare -r croot=/mnt/kube
                declare -r health_endpoint="https://127.0.0.1:2379/health"
                declare -r cert="$(find $croot -name 'system:etcd-peer*.crt' -print -quit)"
                declare -r key="${cert%.crt}.key"
                declare -r cacert="$croot/ca.crt"
                export NSS_SDB_USE_CACHE=no
                [[ -z $cert || -z $key ]] && exit 1
                curl --max-time 2 --silent --cert "${cert//:/\:}" --key "$key" --cacert "$cacert" "$health_endpoint" |grep '{ *"health" *: *"true" *}'
          initialDelaySeconds: 5
          periodSeconds: 5
          failureThreshold: 3
          timeoutSeconds: 3
        resources:
          requests:
            cpu: 10m
            memory: 5Mi
        securityContext:
          privileged: true
      volumes:
      - name: kubecerts
        hostPath:
          path: /etc/kubernetes/static-pod-resources/etcd-member
