discovery_template.yaml

apiVersion: template.openshift.io/v1
kind: Template
labels:
  template: discovery
metadata:
  name: discovery
  annotations:
    description: The Discovery Server application
    tags: discovery
objects:
- apiVersion: v1
  kind: ServiceAccount
  imagePullSecrets:
  - name: discovery-pull-secret
  metadata:
    name: ${DISCOVERY_SA_NAME}
- apiVersion: v1
  kind: Secret
  metadata:
    name: discovery-secrets
  data:
    django-secret-key: ${DJANGO_SECRET_KEY}
    server-password: ${DISCOVERY_SERVER_PASSWORD}
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: discovery-data-volume-claim
  spec:
    accessModes:
    - ReadWriteMany
    volumeMode: Filesystem
    resources:
      requests:
        storage: 8Gi
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: discovery-log-volume-claim
  spec:
    accessModes:
    - ReadWriteMany
    volumeMode: Filesystem
    resources:
      requests:
        storage: 4Gi
- apiVersion: v1
  kind: Service
  metadata:
    name: discovery-server
  spec:
    selector:
      app: discovery-server
      deployment: discovery-server
    ports:
    - port: ${{DISCOVERY_SERVER_PORT}}
      protocol: TCP
      targetPort: ${{DISCOVERY_SERVER_PORT}}
    type: ClusterIP
    internalTrafficPolicy: Cluster
    ipFamilites:
    - IPv4
- apiVersion: v1
  kind: Service
  metadata:
    name: discovery-redis
  spec:
    selector:
      app: discovery-redis
      deployment: discovery-redis
    ports:
    - port: ${{DISCOVERY_REDIS_PORT}}
      protocol: TCP
      targetPort: ${{DISCOVERY_REDIS_PORT}}
    type: ClusterIP
    internalTrafficPolicy: Cluster
    ipFamilites:
    - IPv4
- apiVersion: v1
  kind: Service
  metadata:
    name: discovery-db
  spec:
    selector:
      app: discovery-db
      deployment: discovery-db
    ports:
    - port: ${{DISCOVERY_DBMS_PORT}}
      protocol: TCP
      targetPort: ${{DISCOVERY_DBMS_PORT}}
    type: ClusterIP
    internalTrafficPolicy: Cluster
    ipFamilites:
    - IPv4
- apiVersion: route.openshift.io/v1
  kind: Route
  metadata:
    name: discovery-server
  spec:
    host: ${APPLICATION_DOMAIN}
    port:
      targetPort: ${{DISCOVERY_SERVER_PORT}}
    tls:
      termination: passthrough
      insecureEdgeTerminationPolicy: None
    to:
      kind: Service
      name: discovery-server
      weight: 100
    wildcardPolicy: None
  status:
    ingress:
    - conditions:
      host: ${APPLICATION_DOMAIN}
      wildcardPolicy: None
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: discovery-server
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: discovery-server
    strategy:
      type: Recreate
    template:
      metadata:
        labels:
          app: discovery-server
          deployment: discovery-server
      spec:
        containers:
          - name: discovery-server
            image: ${DISCOVERY_SERVER_IMAGE}
            imagePullPolicy: Always
            serviceAccount: ${DISCOVERY_SA_NAME}
            serviceAccountName: ${DISCOVERY_SA_NAME}
            ports:
              - containerPort: ${{DISCOVERY_SERVER_PORT}}
                protocol: TCP
            securityContext:
              runAsNonRoot: true
              allowPrivilegeEscalation: false
              capabilities:
                drop: ["ALL"]
              seccompProfile:
                type: "RuntimeDefault"
            livenessProbe:
              exec:
                command:
                  - /bin/sh
                  - -c
                  - 'ps axo command | grep -v grep | grep gunicorn'
              failureThreshold: 3
              initialDelaySeconds: 5
              periodSeconds: 10
              successThreshold: 1
              timeoutSeconds: 1
            readinessProbe:
              httpGet:
                path: /api/v1/status/
                port: ${{DISCOVERY_SERVER_PORT}}
                scheme: HTTPS
                httpHeaders:
                  - name: Host
                    value: "discovery-server.${DISCOVERY_NAMESPACE}.svc.cluster.local"
              failureThreshold: 5
              initialDelaySeconds: 10
              periodSeconds: 10
              successThreshold: 1
              timeoutSeconds: 1
            volumeMounts:
            - mountPath: /var/data
              name: discovery-data-volume-claim
            - mountPath: /var/log
              name: discovery-log-volume-claim
            env:
              - name: ANSIBLE_REMOTE_TMP
                value: "${ANSIBLE_REMOTE_TMP}"
              - name: ANSIBLE_LOCAL_TEMP
                value: "${ANSIBLE_LOCAL_TEMP}"
              - name: ANSIBLE_LOG_LEVEL
                value: "3"
              - name: DJANGO_SECRET_PATH
                value: "${DJANGO_SECRET_PATH}"
              - name: DJANGO_SECRET_KEY
                valueFrom:
                  secretKeyRef:
                    key: django-secret-key
                    name: discovery-secrets
              - name: QPC_DBMS
                value: "postgres"
              - name: QPC_DBMS_DATABASE
                value: "qpc"
              - name: QPC_DBMS_HOST
                value: "discovery-db.${DISCOVERY_NAMESPACE}.svc.cluster.local"
              - name: QPC_DBMS_PASSWORD
                value: "qpc"
              - name: QPC_DBMS_PORT
                value: "${DISCOVERY_DBMS_PORT}"
              - name: QPC_DBMS_USER
                value: "qpc"
              - name: QPC_SERVER_PORT
                value: "${DISCOVERY_SERVER_PORT}"
              - name: QPC_SERVER_TIMEOUT
                value: "5"
              - name: QPC_SERVER_USERNAME
                value: "${DISCOVERY_SERVER_USERNAME}"
              - name: QPC_SERVER_PASSWORD
                valueFrom:
                  secretKeyRef:
                    key: server-password
                    name: discovery-secrets
              - name: NETWORK_CONNECT_JOB_TIMEOUT
                value: "6"
              - name: NETWORK_INSPECT_JOB_TIMEOUT
                value: "600"
              - name: QPC_DEBUGPY
                value: "1"
              - name: QPC_LOG_ALL_ENV_VARS_AT_STARTUP
                value: "False"
              - name: REDIS_HOST
                value: "discovery-redis.${DISCOVERY_NAMESPACE}.svc.cluster.local"
              - name: REDIS_PASSWORD
                value: "qpc"
        imagePullSecrets:
        - name: discovery-pull-secret
        restartPolicy: Always
        volumes:
        - name: discovery-data-volume-claim
          persistentVolumeClaim:
            claimName: discovery-data-volume-claim
        - name: discovery-log-volume-claim
          persistentVolumeClaim:
            claimName: discovery-log-volume-claim
    triggers:
    - type: ConfigChange
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: discovery-celery-worker
  spec:
    replicas: "${{DISCOVERY_CELERY_WORKER_MINIMUM_REPLICA_COUNT}}"
    selector:
      matchLabels:
        app: discovery-celery-worker
    strategy:
      type: Recreate
    template:
      metadata:
        labels:
          app: discovery-celery-worker
          deployment: discovery-celery-worker
      spec:
        containers:
          - name: discovery-celery-worker
            image: ${DISCOVERY_SERVER_IMAGE}
            imagePullPolicy: Always
            serviceAccount: ${DISCOVERY_SA_NAME}
            serviceAccountName: ${DISCOVERY_SA_NAME}
            command: [ "/bin/sh", "-c", "/deploy/entrypoint_celery_worker.sh" ]
            securityContext:
              runAsNonRoot: true
              allowPrivilegeEscalation: false
              capabilities:
                drop: ["ALL"]
              seccompProfile:
                type: "RuntimeDefault"
            volumeMounts:
            - mountPath: /var/data
              name: discovery-data-volume-claim
            - mountPath: /var/log
              name: discovery-log-volume-claim
            env:
              - name: ANSIBLE_REMOTE_TMP
                value: "${ANSIBLE_REMOTE_TMP}"
              - name: ANSIBLE_LOCAL_TEMP
                value: "${ANSIBLE_LOCAL_TEMP}"
              - name: DJANGO_SECRET_PATH
                value: "${DJANGO_SECRET_PATH}"
              - name: DJANGO_SECRET_KEY
                valueFrom:
                  secretKeyRef:
                    key: django-secret-key
                    name: discovery-secrets
              - name: REDIS_HOST
                value: "discovery-redis.${DISCOVERY_NAMESPACE}.svc.cluster.local"
              - name: REDIS_PASSWORD
                value: "qpc"
        imagePullSecrets:
        - name: discovery-pull-secret
        restartPolicy: Always
        volumes:
        - name: discovery-data-volume-claim
          persistentVolumeClaim:
            claimName: discovery-data-volume-claim
        - name: discovery-log-volume-claim
          persistentVolumeClaim:
            claimName: discovery-log-volume-claim
    triggers:
    - type: ConfigChange
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: discovery-db
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: discovery-db
    strategy:
      type: Recreate
    template:
      metadata:
        labels:
          app: discovery-db
          deployment: discovery-db
      spec:
        containers:
          - name: discovery-db
            image: registry.redhat.io/rhel8/postgresql-12
            imagePullPolicy: Always
            serviceAccount: ${DISCOVERY_SA_NAME}
            serviceAccountName: ${DISCOVERY_SA_NAME}
            securityContext:
              runAsNonRoot: true
              allowPrivilegeEscalation: false
              capabilities:
                drop: ["ALL"]
              seccompProfile:
                type: "RuntimeDefault"
            volumeMounts:
            - mountPath: /var/lib/pgsql/data
              name: discovery-data-volume-claim
            ports:
              - containerPort: ${{DISCOVERY_DBMS_PORT}}
                protocol: TCP
            readinessProbe:
              exec:
                command: [ "/bin/pg_isready", "-U", "postgres" ]
              failureThreshold: 3
              initialDelaySeconds: 30
              periodSeconds: 10
              successThreshold: 1
              timeoutSeconds: 45
            env:
              - name: POSTGRESQL_USER
                value: "qpc"
              - name: POSTGRESQL_PASSWORD
                value: "qpc"
              - name: POSTGRESQL_DATABASE
                value: "qpc"
        imagePullSecrets:
        - name: discovery-pull-secret
        volumes:
        - name: discovery-data-volume-claim
          persistentVolumeClaim:
            claimName: discovery-data-volume-claim
        restartPolicy: Always
    triggers:
    - type: ConfigChange
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: discovery-redis
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: discovery-redis
    strategy:
      type: Recreate
    template:
      metadata:
        labels:
          app: discovery-redis
          deployment: discovery-redis
      spec:
        containers:
          - name: discovery-redis
            image: registry.redhat.io/rhel9/redis-6
            imagePullPolicy: Always
            serviceAccount: ${DISCOVERY_SA_NAME}
            serviceAccountName: ${DISCOVERY_SA_NAME}
            securityContext:
              runAsNonRoot: true
              allowPrivilegeEscalation: false
              capabilities:
                drop: ["ALL"]
              seccompProfile:
                type: "RuntimeDefault"
            ports:
              - containerPort: ${{DISCOVERY_REDIS_PORT}}
                protocol: TCP
            livenessProbe:
              tcpSocket:
                port: ${{DISCOVERY_REDIS_PORT}}
              initialDelaySeconds: 30
              timeoutSeconds: 5
              periodSeconds: 5
              failureThreshold: 5
              successThreshold: 1
            readinessProbe:
              exec:
                command:
                - redis-cli
                - ping
              initialDelaySeconds: 20
              timeoutSeconds: 5
              periodSeconds: 3
            env:
              - name: REDIS_PASSWORD
                value: "qpc"
        imagePullSecrets:
        - name: discovery-pull-secret
        restartPolicy: Always
    triggers:
    - type: ConfigChange
parameters:
- name: DISCOVERY_NAMESPACE
  displayName: Discovery Project namespace
  description: This is the OpenShift project namespace where Discovery is getting installed.
  value: "discovery"
- name: APPLICATION_DOMAIN
  displayName: Application Hostname
  description: This is the externally accessible URL for the Discovery server.
  value: "discovery-server-discovery.apps-crc.testing"
- name: ANSIBLE_REMOTE_TMP
  displayName: Path for the Ansible Remote Temp directory.
  description: This is the path for the ansible remote temp directory (overrides /.ansible/tmp).
  value: "/var/data/tmp/ansible/remote"
- name: ANSIBLE_LOCAL_TEMP
  displayName: Path for the Ansible Local Temp directory.
  description: This is the path for the ansible temp directory (overrides /.ansible/tmp).
  value: "/var/data/tmp/ansible/local"
- name: DJANGO_SECRET_PATH
  displayName: Path for the Django secret
  description: This is the path for the Django secret
  value: "/var/data/secret.txt"
- name: DJANGO_SECRET_KEY
  displayName: Django secret key
  description: This is the Django App Secret key
  value: "ZGV2ZWxvcG1lbnQK"
- name: DISCOVERY_SERVER_IMAGE
  displayName: Container image for the Discovery server.
  description: This is the image for the Discovery server.
  value: "quay.io/quipucords/quipucords:latest"
- name: DISCOVERY_SERVER_USERNAME
  displayName: Discovery server admin user account.
  description: This is the admin user account for the Discovery server.
  value: "admin"
- name: DISCOVERY_SERVER_PASSWORD
  displayName: Discovery server admin password.
  description: This is the password for the admin user account of the Discovery server.
  value: ""
- name: DISCOVERY_SA_NAME
  displayName: Discovery Service Account Name
  description: This is the name for the Discovery Service Account.
  value: "discovery-sa"
- name: DISCOVERY_CELERY_WORKER_MINIMUM_REPLICA_COUNT
  displayName: Discovery Celery Worker Minimum Replica Count
  description: This is the starting number of Celery workers replicas requested.
  value: '3'
- name: DISCOVERY_SERVER_PORT
  displayName: Discovery Server SSL Port (API/UI)
  description: This is the SSL port for the quipucords server.
  value: "8443"
- name: DISCOVERY_REDIS_PORT
  displayName: Discovery Redis Port
  description: This is the port for the quipucords redis server.
  value: "6379"
- name: DISCOVERY_DBMS_PORT
  displayName: Discovery PostgresQL Database Port
  description: This is the port for the quipucords postgresql database.
  value: "5432"