# Copyright 2019 Copyright (c) 2019 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ .Values.name }}
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ .Values.name }}
    component: etcd
spec:
  updateStrategy:
    type: RollingUpdate
  serviceName: garden-etcd-{{.Values.role}}-client
  replicas: {{ .Values.replicas }}
  selector:
    matchLabels:
      app: {{ .Values.name }}
      component: etcd
  template:
    metadata:
      annotations:
        checksum/configmap-etcd-bootstrap-config: {{ include (print $.Template.BasePath "/configmap-etcd-bootstrap.yaml") . | sha256sum }}
        checksum/secret-etcd-ca: {{ include (print $.Template.BasePath "/secret-etcd-ca.yaml") . | sha256sum }}
        checksum/secret-etcd-server: {{ include (print $.Template.BasePath "/secret-etcd-server-tls.yaml") . | sha256sum }}
        checksum/secret-etcd-client: {{ include (print $.Template.BasePath "/secret-etcd-client-tls.yaml") . | sha256sum }}
        checksum/secret-etcd-backup: {{ include (print $.Template.BasePath "/secret-etcd-backup.yaml") . | sha256sum }}
{{- if .Values.podAnnotations }}
{{ toYaml .Values.podAnnotations | indent 8 }}
{{- end }}
      labels:
        app: {{ .Values.name }}
        component: etcd
    spec:
      serviceAccountName: {{ .Values.serviceAccount }}
      containers:
      - name: etcd
        image: {{ index .Values.images "etcd" }}
        imagePullPolicy: IfNotPresent
        command:
        - /bootstrap/bootstrap.sh
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 15
          periodSeconds: 5
        livenessProbe:
          exec:
            command:
            - /bin/sh
            - -ec
            - ETCDCTL_API=3
            - etcdctl
            - --cert=/var/etcd/ssl/client/tls.crt
            - --key=/var/etcd/ssl/client/tls.key
            - --cacert=/var/etcd/ssl/ca/ca.crt
            - --endpoints=https://{{ .Values.name }}-0:2379
            - get
            - foo
          initialDelaySeconds: 15
          periodSeconds: 5
        ports:
        - containerPort: 2380
          name: serverport
          protocol: TCP
        - containerPort: 2379
          name: clientport
          protocol: TCP
        resources:
{{ toYaml .Values.resources | indent 10 }}
        volumeMounts:
        - name: {{ .Values.name }}
          mountPath: /var/etcd/data
        - name: etcd-bootstrap
          mountPath: /bootstrap
        - name: ca-etcd
          mountPath: /var/etcd/ssl/ca
        - name: etcd-server-tls
          mountPath: /var/etcd/ssl/server
        - name: etcd-client-tls
          mountPath: /var/etcd/ssl/client
      - name: backup-restore
        command:
        - etcdbrctl
        - server
        - --schedule={{ .Values.backup.schedule }}
        - --max-backups={{ .Values.backup.maxBackups }}
        - --data-dir=/var/etcd/data/new.etcd
        - --storage-provider={{ .Values.backup.storageProvider }}
        - --garbage-collection-policy={{ .Values.backup.garbageCollectionPolicy }}
        - --store-prefix={{ .Values.name }}
        - --cert=/var/etcd/ssl/client/tls.crt
        - --key=/var/etcd/ssl/client/tls.key
        - --cacert=/var/etcd/ssl/ca/ca.crt
        - --insecure-transport=false
        - --insecure-skip-tls-verify=false
        - --endpoints=https://{{ .Values.name }}-0:2379
        - --etcd-connection-timeout=300s
        image: {{ index .Values.images "etcd-backup-restore" }}
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8080
          name: server
          protocol: TCP
        resources:
{{ toYaml .Values.backup.resources | indent 10 }}
        env:
        - name: STORAGE_CONTAINER
          value: {{ .Values.backup.storageContainer }}
{{- if .Values.backup.env }}
{{ toYaml .Values.backup.env | indent 8 }}
{{- end }}
        volumeMounts:
        - name: {{ .Values.name }}
          mountPath: /var/etcd/data
        - name: ca-etcd
          mountPath: /var/etcd/ssl/ca
        - name: etcd-client-tls
          mountPath: /var/etcd/ssl/client
{{- if .Values.backup.volumeMounts }}
{{ toYaml .Values.backup.volumeMounts | indent 8 }}
{{- end }}
      volumes:
      - name: etcd-bootstrap
        configMap:
          name: {{ .Values.name }}-bootstrap
          defaultMode: 356
      - name: etcd-server-tls
        secret:
          secretName: {{ .Values.name }}-server
      - name: etcd-client-tls
        secret:
          secretName: {{ .Values.name }}-client
      - name: ca-etcd
        secret:
          secretName: {{ .Values.name }}-ca
{{- if .Values.backup.storageProvider }}
      - name: etcd-backup
        secret:
          secretName: {{ .Values.name }}-backup
{{- if .Values.backup.secretItems }}
{{ toYaml .Values.backup.secretItems | indent 10 }}
{{- end}}
{{- end }}
  volumeClaimTemplates:
  - metadata:
      name: {{ .Values.name }}
    spec:
      accessModes:
      - "ReadWriteOnce"
      resources:
        requests:
          storage: 10Gi