packit-service.yml.j2

# Copyright Contributors to the Packit project.
# SPDX-License-Identifier: MIT

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: packit-service
  annotations:
    # https://docs.openshift.com/container-platform/4.11/openshift_images/triggering-updates-on-imagestream-changes.html
    image.openshift.io/triggers: >-
      [{"from":{"kind":"ImageStreamTag","name":"packit-service:{{ deployment }}"},"fieldPath":"spec.template.spec.containers[?(@.name==\"packit-service\")].image"}]
{% if managed_platform %}
  labels:
    app-code: "{{ appcode }}"
    service-phase: "{{ servicephase }}"
    cost-center: "{{ costcenter }}"
{% endif %}
spec:
  selector:
    matchLabels:
      component: packit-service
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        component: packit-service
{% if managed_platform %}
        paas.redhat.com/appcode: {{ appcode }}
{% endif %}
    spec:
      volumes:
        - name: packit-secrets
          secret:
            secretName: packit-secrets
        - name: packit-config
          secret:
            secretName: packit-config
{% if with_fluentd_sidecar %}
        - name: fluentd-config
          configMap: {name: fluentd-config}
{% endif %}
        - name: gh-secrets
          secret:
            secretName: github-app-private-key
        - name: centpkg-sig
          secret:
            secretName: centpkg-sig
      containers:
        - name: packit-service
          image: packit-service:{{ deployment }}
          ports:
            - containerPort: 8443
              protocol: TCP
          env:
            - name: PROJECT
              value: {{ project }}
            - name: DEPLOYMENT
              value: {{ deployment }}
            - name: DISTGIT_URL
              value: {{ distgit_url }}
            - name: DISTGIT_NAMESPACE
              value: {{ distgit_namespace }}
            - name: REDIS_SERVICE_HOST
              value: {{ redis_hostname }}
            - name: POSTGRESQL_USER
              valueFrom: {secretKeyRef: {name: postgres-secret, key: database-user}}
            - name: POSTGRESQL_PASSWORD
              valueFrom: {secretKeyRef: {name: postgres-secret, key: database-password}}
            - name: POSTGRESQL_HOST
              valueFrom: {secretKeyRef: {name: postgres-secret, key: database-host}}
            - name: POSTGRESQL_DATABASE
              valueFrom: {secretKeyRef: {name: postgres-secret, key: database-name}}
            - name: SENTRY_SECRET
              valueFrom: {secretKeyRef: {name: sentry, key: dsn}}
            - name: SYSLOG_HOST
              # localhost doesn't work
              value: "127.0.0.1"
          volumeMounts:
            - name: packit-secrets
              mountPath: /secrets
              readOnly: true
            - name: packit-config
              mountPath: /home/packit/.config
              readOnly: true
            - name: gh-secrets
              mountPath: /gh-secrets
              readOnly: true
            - name: centpkg-sig
              mountPath: /etc/rpkg/centpkg-sig.conf
              subPath: centpkg-sig.conf
          command:
            - /usr/bin/run_httpd.sh
          resources:
            requests:
              memory: "320Mi"
              cpu: "10m"
              ephemeral-storage: "300Ki"
            limits:
              # run_httpd.sh does 'alembic upgrade head' which might require more memory
              # If you see '/usr/bin/run_httpd.sh: line 16:   Killed     alembic upgrade head'
              # you have to temporarily increase (in webUI/console) the limit
              # and once the alembic upgrade passes, revert.
              memory: "{{ '4Gi' if project == 'packit--prod' else '512Mi' }}"
              cpu: "200m"
          # In TLS world, hostname needs to match whatever is set in the cert
          # in our cause, k8s is doing here something like curl https://172.15.2.4:8443/api/healthz/
          # which will fail TLS validation.
          # So we need to connect to prod.packit.dev.
          #   Liveness probe failed: Get https://10.131.30.42:8443/api/healthz/: local error: tls: no renegotiation
          # Comment probes out, they just don't work.
          # readinessProbe:
          #   httpGet:
          #     host: {{ deployment }}.packit.dev
          #     scheme: HTTPS
          #     path: /api/healthz/
          #   initialDelaySeconds: 10
          # livenessProbe:
          #   httpGet:
          #     host: {{ deployment }}.packit.dev
          #     scheme: HTTPS
          #     path: /api/healthz/
          #   initialDelaySeconds: 30
{% if with_fluentd_sidecar %}
        # See ../docs/logs.md
        - name: fluentd-sidecar
          image: fluentd:{{ deployment }}
          ports:
            - containerPort: 5140
              protocol: UDP
          env:
            - name: SPLUNK_HEC_HOST
              valueFrom: {secretKeyRef: {name: splunk, key: hec-host}}
            - name: SPLUNK_HEC_PORT
              valueFrom: {secretKeyRef: {name: splunk, key: hec-port}}
            - name: SPLUNK_HEC_TOKEN
              valueFrom: {secretKeyRef: {name: splunk, key: hec-token}}
          volumeMounts:
            - name: fluentd-config
              mountPath: /fluentd/etc
              readOnly: true
          resources:
            requests: {memory: "128Mi", cpu: "10m"}
            limits: {memory: "128Mi", cpu: "100m"}
{% endif %}
---
apiVersion: v1
kind: Service
metadata:
  name: packit-service
{% if managed_platform %}
  labels:
    paas.redhat.com/appcode: {{ appcode }}
{% endif %}
spec:
  ports:
    - name: prod-packit
      port: 443
      protocol: TCP
      targetPort: 8443
  selector:
    component: packit-service
---
kind: Route
apiVersion: route.openshift.io/v1
metadata:
  name: packit-service
{% if managed_platform %}
  labels:
    paas.redhat.com/appcode: {{ appcode }}
    shard: external
{% endif %}
spec:
# for local deployment (dev) creates default route for testing.
# e.g https://packit-service-myproject.127.0.0.1.nip.io/
# For dev/prod creates host {dev,prod}.packit.dev
{% if deployment != 'dev' %}
  host: "{{ deployment }}.{{ service+'.' if service != 'packit' else '' }}packit.dev"
{% endif %}

  port:
    targetPort: prod-packit
  to:
    kind: Service
    name: packit-service
  tls:
    # not sure about this one, whether we should do it in httpd or here
    insecureEdgeTerminationPolicy: Redirect
    termination: passthrough
---
kind: ImageStream
apiVersion: image.openshift.io/v1
metadata:
  name: packit-service
spec:
  tags:
    - name: {{ deployment }}
      from:
        kind: DockerImage
        name: {{ image }}
      importPolicy:
        # Periodically query registry to synchronize tag and image metadata.
        scheduled: {{ auto_import_images }}
  lookupPolicy:
    # allows all resources pointing to this image stream to use it in the image field
    local: true