apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: puppetdb
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: puppetdb
  namespace: puppet
spec:
  selector:
    matchLabels:
      app.kubernetes.io/component: puppetdb
      app.kubernetes.io/name: puppetserver
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  template:
    metadata:
      annotations:
        configmap.reloader.stakater.com/auto: "true"
      labels:
        app.kubernetes.io/component: puppetdb
        app.kubernetes.io/instance: puppetserver
        app.kubernetes.io/name: puppetserver
        app.kubernetes.io/version: 8.8.0
    spec:
      hostname: puppetdb
      imagePullSecrets: null
      containers:
        - name: puppetdb
          image: ghcr.io/openvoxproject/openvoxdb:8.9.0-main
          imagePullPolicy: IfNotPresent
          resources:
            limits:
              cpu: 1
              memory: 1536Mi
            requests:
              cpu: 50m
              memory: 768Mi
          ports:
            - containerPort: 8080
              name: pdb-http
            - containerPort: 8081
              name: pdb-https
          envFrom:
            - configMapRef:
                name: puppetdb-config
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPENVOXDB_POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  key: password
                  name: postgres-credentials
            - name: OPENVOXDB_POSTGRES_USER
              valueFrom:
                secretKeyRef:
                  key: username
                  name: postgres-credentials
            - name: OPENVOXDB_READ_POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  key: password
                  name: postgres-read-credentials
            - name: OPENVOXDB_READ_POSTGRES_USER
              valueFrom:
                secretKeyRef:
                  key: username
                  name: postgres-read-credentials
          securityContext:
            allowPrivilegeEscalation: false
            # Root entrypoint drops to the puppetdb user via `runuser` (needs
            # SETUID/SETGID) after chowning SSL/data dirs (CHOWN). Cannot run
            # non-root: the image entrypoint requires a root start.
            capabilities:
              add:
                - CHOWN
                - DAC_OVERRIDE
                - FOWNER
                - SETGID
                - SETUID
              drop:
                - all
          volumeMounts:
            - mountPath: /opt/puppetlabs/server/data/puppetdb
              name: puppetdb-storage
            - mountPath: /opt/puppetlabs/server/data/puppetdb/stockpile
              name: puppetdb-storage
              subPathExpr: stockpile/$(POD_NAME)
            - mountPath: /etc/puppetlabs/puppetdb/conf.d/read-database.conf
              name: puppetdb-read-database-conf
              subPath: read-database.conf
      initContainers:
        - name: create-log-dir
          image: docker.io/busybox:1.37
          command:
            - sh
            - -c
          args:
            - mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
          resources:
            limits:
              cpu: 20m
              memory: 32Mi
            requests:
              cpu: 20m
              memory: 32Mi
          securityContext:
            runAsUser: 999
            runAsGroup: 999
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - all
          volumeMounts:
            - mountPath: /opt/puppetlabs/server/data/puppetdb
              name: puppetdb-storage
            - mountPath: /opt/puppetlabs/server/data/puppetdb/stockpile
              name: puppetdb-storage
              subPathExpr: stockpile/$(POD_NAME)

        - name: pgchecker
          image: docker.io/busybox:1.37
          imagePullPolicy: IfNotPresent
          command:
            - sh
            - -c
          args:
            - |
              echo 'Waiting for PostgreSQL to become ready...'
              until printf "." && nc -z -w 2 puppet-postgres-pooler 5432; do
                  sleep 2;
              done;
              echo 'PostgreSQL OK ✓'
          resources:
            limits:
              cpu: 20m
              memory: 32Mi
            requests:
              cpu: 20m
              memory: 32Mi
          securityContext:
            runAsUser: 1000
            runAsGroup: 1000
            runAsNonRoot: true
            allowPrivilegeEscalation: false

        - name: wait-puppetserver
          image: curlimages/curl:8.11.1
          imagePullPolicy: IfNotPresent
          command:
            - sh
            - -c
          args:
            - |
              echo 'Waiting for puppetserver to become ready...'
              until printf "." && curl --silent --fail --insecure 'https://puppetca:8140/status/v1/simple' | grep -q '^running$'; do
                sleep 2;
              done;
              echo 'Puppetserver OK ✓'
          resources:
            limits:
              cpu: 20m
              memory: 32Mi
            requests:
              cpu: 20m
              memory: 32Mi
          securityContext:
            runAsUser: 1000
            runAsGroup: 1000
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      securityContext:
        fsGroup: 999
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      volumes:
        - name: puppetdb-storage
          persistentVolumeClaim:
            claimName: puppetserver-puppetdb-claim
        - name: puppetdb-read-database-conf
          configMap:
            name: puppetdb-read-database-conf