service-tls-template.yml

---
apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: maestro-service
  annotations:
    openshift.io/display-name: maestro
    description: Example for Maestro e2e deployment
    tags: golang,uhc,service-delivery
    iconClass: icon-shadowman
    template.openshift.io/provider-display-name: Red Hat, Inc.
    template.openshift.io/documentation-url: https://gitlab.cee.redhat.com/service/
labels:
  template: maestro
parameters:

- name: ENVIRONMENT
  displayName: Environment
  description: Which maestro environment to use for this deployment
  value: production

- name: IMAGE_REGISTRY
  displayName: Image Registry
  required: true

- name: IMAGE_REPOSITORY
  displayName: Image Repository
  required: true

- name: IMAGE_TAG
  displayName: Image tag
  value: latest

- name: KLOG_V
  displayName: KLOG V Level
  description: Log verbosity level
  value: "2"

- name: MEMORY_REQUEST
  description: Memory request for the API pods.
  value: "512Mi"

- name: MEMORY_LIMIT
  description: Memory limit for the API pods.
  value: "1Gi"

- name: CPU_REQUEST
  description: CPU request for the API pods.
  value: "200m"

- name: CPU_LIMIT
  description: CPU limit for the API pods.
  value: "1"

- name: JWKS_URL
  displayName: JWK Token Certificate URL

- name: JWKS_CA
  displayName: JWK Token Certificate CA

- name: OCM_BASE_URL
  displayName: OCM API Base URL
  description: Base path for all OCM APIs

- name: OCM_DEBUG
  displayName: OCM API Debug mode
  description: Debug mode for OCM API client
  value: "false"

- name: SERVER_REPLICAS
  description: Number of replicas of the service to run.
  value: "1"

- name: ENABLE_JWT
  displayName: Enable JWT
  description: Enable JWT authentication validation
  value: "true"

- name: ENABLE_HTTPS
  displayName: Enable HTTPS
  description: Enable HTTPS rather than HTTP
  value: "true"

- name: HTTP_SERVER_BINDPORT
  displayName: HTTP Server Bindport
  description: HTTP server bind port
  value: "8000"

- name: ENABLE_GRPC_SERVER 
  displayName: Enable gRPC server
  description: Enable gRPC server
  value: "false"

- name: GRPC_SERVER_BINDPORT
  displayName: gRPC Server Bindport
  description: gRPC server bind port
  value: "8090"

- name: GRPC_BROKER_BINDPORT
  displayName: gRPC Broker Bindport
  description: gRPC broker bind port
  value: "8091"

- name: MESSAGE_DRIVER_TYPE
  displayName: Message Driver Type
  description: Message driver type, mqtt or grpc.
  value: mqtt

- name: DISABLE_GRPC_TLS
  displayName: Disable gRPC TLS
  description: Disable TLS for gRPC server
  value: "false"

- name: METRICS_SERVER_BINDPORT
  displayName: Metrics Server Bindport
  description: Metrics server bind port
  value: "8080"

- name: HEALTH_CHECK_SERVER_BINDPORT
  displayName: Health check Server Bindport
  description: Health check server bind port
  value: "8083"

- name: HTTP_SERVER_HOSTNAME
  displayName: HTTP Server Hostname
  description: Server's public hostname
  value: ""

- name: ENABLE_AUTHZ
  displayName: Enable Authz
  description: Enable Authorization on endpoints, should only be disabled for debug
  value: "true"

- name: DB_MAX_OPEN_CONNS
  displayName: Maximum Open Database Connections
  description: Maximum number of open database connections per pod
  value: "50"

- name: DB_SSLMODE
  displayName: DB SSLmode
  description: Database ssl mode (disable | require | verify-ca | verify-full)
  value: "verify-full"

- name: ENABLE_DB_DEBUG
  displayName: Enable DB Debug
  description: framework's debug mode
  value: "false"

- name: ENABLE_METRICS_HTTPS
  displayName: Enable Metrics HTTPS
  description: Enable HTTPS for metrics server
  value: "false"

- name: ENABLE_OCM_MOCK
  displayName: Enable OCM Mock
  description: Enable mock uhc client
  value: "false"

- name: HTTP_READ_TIMEOUT
  displayName: HTTP Read Timeout
  description: HTTP server read timeout
  value: 5s

- name: HTTP_WRITE_TIMEOUT
  displayName: HTTP Write Timeout
  description: HTTP server write timeout
  value: 30s

- name: LABEL_METRICS_INCLUSION_DURATION
  displayName: Label metrics inclusion duration
  description: A cluster's last telemetry date needs be within in this duration in order to have labels collected
  value: "168h"

- name: ENABLE_SENTRY
  displayName: Enable Sentry Error Reporting
  value: "false"

- name: SENTRY_URL
  displayName: Sentry base URL
  description: Base URL (without https://) of sentry server
  value: "glitchtip.devshift.net"

- name: SENTRY_PROJECT
  displayName: Sentry Project ID
  value: "53"

- name: ENABLE_SENTRY_DEBUG
  displayName: Enable Sentry Debug Logging
  value: "false"

- name: SENTRY_TIMEOUT
  displayName: Sentry Timeout
  description: Timeout for all Sentry operations
  value: "5s"

- name: LIVENESS_PROBE_INIT_DELAY_SECONDS
  value: "25"

- name: READINESS_PROBE_INIT_DELAY_SECONDS
  value: "20"

- name: SUBSCRIPTION_TYPE
  value: "shared"

- name: MAESTRO_SVC_TYPE
  value: "ClusterIP"

- name: MAESTRO_SVC_NODE_PORT
  value: "0"

- name: GRPC_SVC_TYPE
  value: "ClusterIP"

- name: GRPC_SVC_NODE_PORT
  value: "0"

objects:
  - kind: ServiceAccount
    apiVersion: v1
    metadata:
      name: maestro
      labels:
        app: maestro

  - apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: maestro
    rules:
    - apiGroups: ["authorization.k8s.io"]
      resources: ["subjectaccessreviews"]
      verbs: ["create"]
    - apiGroups: ["authentication.k8s.io"]
      resources: ["tokenreviews"]
      verbs: ["create"]

  - apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: maestro
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: maestro
    subjects:
      - kind: ServiceAccount
        name: maestro
        namespace: maestro

  - apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: grpc-pub-sub
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: grpc-pub-sub
    subjects:
    - kind: User
      name: grpc-client
      apiGroup: rbac.authorization.k8s.io
    - kind: ServiceAccount
      name: grpc-client
      namespace: maestro

  - apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: grpc-client

  - apiVersion: v1
    kind: Secret
    metadata:
      name: grpc-client-token
      annotations:
        kubernetes.io/service-account.name: grpc-client
    type: kubernetes.io/service-account-token

  - kind: Deployment
    apiVersion: apps/v1
    metadata:
      name: maestro
      labels:
        app: maestro
    spec:
      selector:
        matchLabels:
          app: maestro
      replicas: ${{SERVER_REPLICAS}}
      strategy:
        rollingUpdate:
          maxSurge: 25%
          maxUnavailable: 25%
        type: RollingUpdate
      template:
        metadata:
          labels:
            app: maestro
        spec:
          serviceAccountName: maestro
          volumes:
          - name: logging-config
            configMap:
              name: maestro-logging-config
              optional: true
          - name: tls
            secret:
              secretName: maestro-tls
          - name: grpc-broker-tls
            secret:
              secretName: maestro-grpc-broker-cert
          - name: service
            secret:
              secretName: maestro
          - name: rds
            secret:
              secretName: maestro-rds
          - name: ${MESSAGE_DRIVER_TYPE}
            secret:
              secretName: maestro-mqtt
          - name: authentication
            configMap:
              name: authentication
          - name: mqtt-certs
            secret:
              secretName: maestro-server-certs
          - name: maestro-grpc-cert
            secret:
              secretName: maestro-grpc-cert
          initContainers:
          - name: migration
            image: ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}:${IMAGE_TAG}
            imagePullPolicy: IfNotPresent
            volumeMounts:
            - name: service
              mountPath: /secrets/service
            - name: rds
              mountPath: /secrets/rds
            command:
            - /usr/local/bin/maestro
            - migration
            - --db-host-file=/secrets/rds/db.host
            - --db-port-file=/secrets/rds/db.port
            - --db-user-file=/secrets/rds/db.user
            - --db-password-file=/secrets/rds/db.password
            - --db-name-file=/secrets/rds/db.name
            - --db-rootcert=/secrets/rds/db.ca_cert
            - --db-sslmode=${DB_SSLMODE}
            - --alsologtostderr
            - -v=${KLOG_V}
          containers:
          - name: service
            image: ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}:${IMAGE_TAG}
            imagePullPolicy: IfNotPresent
            volumeMounts:
            - name: logging-config
              mountPath: /configs/logging
            - name: tls
              mountPath: /secrets/tls
            - name: grpc-broker-tls
              mountPath: /secrets/grpc-broker-tls
            - name: service
              mountPath: /secrets/service
            - name: rds
              mountPath: /secrets/rds
            - name: ${MESSAGE_DRIVER_TYPE}
              mountPath: /secrets/${MESSAGE_DRIVER_TYPE}
            - name: authentication
              mountPath: /configs/authentication
            - name: mqtt-certs
              mountPath: /secrets/mqtt-certs
            - name: maestro-grpc-cert
              mountPath: /secrets/maestro-grpc-cert
            env:
              - name: "MAESTRO_ENV"
                value: "${ENVIRONMENT}"
              - name: POD_NAME
                valueFrom:
                  fieldRef:
                    fieldPath: metadata.name
            command:
            - /usr/local/bin/maestro
            - server
            - --subscription-type=${SUBSCRIPTION_TYPE}
            - --client-id=maestro-$(POD_NAME)
            - --db-host-file=/secrets/rds/db.host
            - --db-port-file=/secrets/rds/db.port
            - --db-user-file=/secrets/rds/db.user
            - --db-password-file=/secrets/rds/db.password
            - --db-name-file=/secrets/rds/db.name
            - --db-rootcert=/secrets/rds/db.ca_cert
            - --db-sslmode=${DB_SSLMODE}
            - --message-broker-type=${MESSAGE_DRIVER_TYPE}
            - --message-broker-config-file=/secrets/${MESSAGE_DRIVER_TYPE}/config.yaml
            - --enable-ocm-mock=${ENABLE_OCM_MOCK}
            - --ocm-client-id-file=/secrets/service/ocm-service.clientId
            - --ocm-client-secret-file=/secrets/service/ocm-service.clientSecret
            - --ocm-base-url=${OCM_BASE_URL}
            - --ocm-debug=${OCM_DEBUG}
            - --https-cert-file=/secrets/tls/tls.crt
            - --https-key-file=/secrets/tls/tls.key
            - --enable-grpc-server=${ENABLE_GRPC_SERVER}
            - --disable-grpc-tls=${DISABLE_GRPC_TLS}
            - --grpc-authn-type=token
            - --grpc-broker-bindport=${GRPC_BROKER_BINDPORT}
            - --grpc-broker-client-ca-file=/secrets/grpc-broker-tls/ca.crt
            - --grpc-broker-tls-cert-file=/secrets/grpc-broker-tls/server.crt
            - --grpc-broker-tls-key-file=/secrets/grpc-broker-tls/server.key
            - --grpc-server-bindport=${GRPC_SERVER_BINDPORT}
            - --grpc-client-ca-file=/secrets/maestro-grpc-cert/ca.crt
            - --grpc-tls-cert-file=/secrets/maestro-grpc-cert/server.crt
            - --grpc-tls-key-file=/secrets/maestro-grpc-cert/server.key
            - --acl-file=/configs/authentication/acl.yml
            - --jwk-cert-file=/configs/authentication/jwks.json
            - --jwk-cert-url=${JWKS_URL}
            - --enable-jwt=${ENABLE_JWT}
            - --enable-https=${ENABLE_HTTPS}
            - --server-hostname=${HTTP_SERVER_HOSTNAME}
            - --http-server-bindport=${HTTP_SERVER_BINDPORT}
            - --health-check-server-bindport=${HEALTH_CHECK_SERVER_BINDPORT}
            - --enable-health-check-https=${ENABLE_HTTPS}
            - --db-max-open-connections=${DB_MAX_OPEN_CONNS}
            - --enable-authz=${ENABLE_AUTHZ}
            - --enable-db-debug=${ENABLE_DB_DEBUG}
            - --enable-metrics-https=${ENABLE_METRICS_HTTPS}
            - --enable-sentry=${ENABLE_SENTRY}
            - --enable-sentry-debug=${ENABLE_SENTRY_DEBUG}
            - --sentry-url=${SENTRY_URL}
            - --sentry-project=${SENTRY_PROJECT}
            - --sentry-timeout=${SENTRY_TIMEOUT}
            - --sentry-key-file=/secrets/service/sentry.key
            - --http-read-timeout=${HTTP_READ_TIMEOUT}
            - --http-write-timeout=${HTTP_WRITE_TIMEOUT}
            - --label-metrics-inclusion-duration=${LABEL_METRICS_INCLUSION_DURATION}
            - --alsologtostderr
            - -v=${KLOG_V}
            resources:
              requests:
                cpu: ${CPU_REQUEST}
                memory: ${MEMORY_REQUEST}
              limits:
                cpu: ${CPU_LIMIT}
                memory: ${MEMORY_LIMIT}
            livenessProbe:
              httpGet:
                path: /healthcheck
                port: 8083
                scheme: HTTPS
              initialDelaySeconds: ${{LIVENESS_PROBE_INIT_DELAY_SECONDS}}
              periodSeconds: 10
            readinessProbe:
              httpGet:
                path: /healthcheck
                port: 8083
                scheme: HTTPS
                httpHeaders:
                - name: User-Agent
                  value: Probe
              initialDelaySeconds: ${{READINESS_PROBE_INIT_DELAY_SECONDS}}
              periodSeconds: 5

  - kind: Service
    apiVersion: v1
    metadata:
      name: maestro
      labels:
        app: maestro
        port: api
      annotations:
        description: Exposes and load balances the maestro pods
        service.alpha.openshift.io/serving-cert-secret-name: maestro-tls
    spec:
      selector:
        app: maestro
      type: ${MAESTRO_SVC_TYPE}
      ports:
        - nodePort: ${{MAESTRO_SVC_NODE_PORT}}
          port: 8000
          targetPort: 8000
          protocol: TCP

  # Services for diagnostic ports (not part of main service because we
  # don't want exposing them externally through same route).
  - kind: Service
    apiVersion: v1
    metadata:
      name: maestro-metrics
      labels:
        app: maestro
        port: metrics
      annotations:
        description: Exposes and load balances the maestro pods restful api endpoint
        service.alpha.openshift.io/serving-cert-secret-name: maestro-metrics-tls
    spec:
      selector:
        app: maestro
      ports:
      - port: 8080
        targetPort: 8080
        name: metrics

  - kind: Service
    apiVersion: v1
    metadata:
      name: maestro-grpc
      labels:
        app: maestro
        port: grpc
      annotations:
        description: Exposes and load balances the maestro pods grpc endpoint
    spec:
      selector:
        app: maestro
      type: ${GRPC_SVC_TYPE}
      ports:
        - name: grpc
          nodePort: ${{GRPC_SVC_NODE_PORT}}
          port: 8090
          targetPort: 8090
          protocol: TCP

  - kind: Service
    apiVersion: v1
    metadata:
      name: maestro-grpc-broker
      labels:
        app: maestro
        port: grpc-broker
      annotations:
        description: Exposes and load balances the maestro pods grpc broker endpoint
    spec:
      selector:
        app: maestro
      ports:
        - name: grpc-broker
          port: 8091
          targetPort: 8091
          protocol: TCP

  - apiVersion: v1
    kind: Service
    metadata:
      name: maestro-healthcheck
      labels:
        app: maestro
        port: healthcheck
    spec:
      selector:
        app: maestro
      ports:
      - port: 8083
        targetPort: 8083