418 lines
15 KiB
YAML
418 lines
15 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ .Release.Name }}
|
|
labels:
|
|
app: {{ .Release.Name }}
|
|
spec:
|
|
replicas: {{ .Values.replicaCount }}
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ .Release.Name }}
|
|
spec:
|
|
containers:
|
|
- name: {{ .Release.Name }}
|
|
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
ports:
|
|
- containerPort: {{ .Values.container.port }}
|
|
env:
|
|
- name: NODE_ENV
|
|
value: {{ .Values.container.env }}
|
|
- name: PORT
|
|
value: "{{ .Values.container.port }}"
|
|
- name: DOMAIN
|
|
value: "bridgemanaccessible.ca"
|
|
- name: ACCOUNTS_DEV_PORT
|
|
value: "9010"
|
|
- name: ACCOUNTS_SUBDOMAIN_PREFIX
|
|
value: "account"
|
|
# OAuth Implementation Stuff
|
|
- name: BASE_APP_URL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-oauth-credentials
|
|
key: base-app-url
|
|
- name: APP_ABBRV
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-oauth-credentials
|
|
key: app-abbreviation
|
|
- name: APP_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-oauth-credentials
|
|
key: app-name
|
|
- name: SERVICE_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-oauth-credentials
|
|
key: service-name
|
|
- name: DEV_PORT
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-oauth-credentials
|
|
key: dev-port
|
|
# Database credentials
|
|
- name: DB_HOST
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-db-credentials
|
|
key: db-host
|
|
- name: DB_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-db-credentials
|
|
key: db-name
|
|
- name: DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-db-password
|
|
key: password
|
|
- name: DB_PORT
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-db-credentials
|
|
key: db-port
|
|
- name: DB_USER
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-db-credentials
|
|
key: db-user
|
|
# NoSQL Credentials
|
|
{{- if eq .Values.nosql.type "mongodb" }}
|
|
- name: STORAGE_ACCOUNT_CONNECTION_STRING
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-mongo-credentials
|
|
key: connection-string
|
|
{{- else if eq .Values.nosql.type "azure" }}
|
|
- name: STORAGE_ACCOUNT_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-azure-tables-credentials
|
|
key: key
|
|
- name: STORAGE_ACCOUNT_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-azure-tables-config
|
|
key: name
|
|
{{- end }}
|
|
# NoSQL Grouping Names
|
|
- name: ACCESS_PROPERTIES_STORAGE_TABLE_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-nosql-grouping
|
|
key: access-properties
|
|
- name: LOCALE_PROPERTIES_STORAGE_TABLE_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-nosql-grouping
|
|
key: locales
|
|
- name: ORDER_PROPERTIES_STORAGE_TABLE_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-nosql-grouping
|
|
key: order-properties
|
|
- name: PRICE_PROPERTIES_STORAGE_TABLE_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-nosql-grouping
|
|
key: price-properties
|
|
- name: SERVICE_CATEGORY_PROPERTIES_STORAGE_TABLE_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-nosql-grouping
|
|
key: service-category-properties
|
|
- name: SERVICE_PROPERTIES_STORAGE_TABLE_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-nosql-grouping
|
|
key: service-properties
|
|
# -- Secrets Vault (Hashicorp Vault OR Azure Key Vault) --
|
|
{{- if .Values.vault.enabled }}
|
|
{{- if eq .Values.vault.type "azure" }}
|
|
- name: KEYVAULT_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-vault-secret
|
|
key: client-id
|
|
- name: KEYVAULT_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-vault-secret
|
|
key: client-secret
|
|
- name: KEYVAULT_NAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-vault-secret
|
|
key: name
|
|
- name: KEYVAULT_TENANT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-vault-secret
|
|
key: tenant-id
|
|
{{- else if eq .Values.vault.type "hashicorp" }}
|
|
- name: VAULT_NAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-vault-secret
|
|
key: vault-name
|
|
- name: VAULT_PORT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-vault-secret
|
|
key: vault-port
|
|
{{- end }}
|
|
{{- end }}
|
|
# Caching Server Variables
|
|
- name: CACHE_HOSTNAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-cache-configmap
|
|
key: hostname
|
|
- name: CACHE_PORT
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-cache-configmap
|
|
key: port
|
|
- name: CACHE_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-cache-credentials
|
|
key: password
|
|
# Email (Azure Communication Services API credentials, etc...)
|
|
{{- if and (.Values.comms.email.enabled) (eq .Values.comms.email.type "acs") }}
|
|
- name: EMAIL_CONNECTION_STRING
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-email-secret
|
|
key: connection-string
|
|
{{- end }}
|
|
# Third-Party Integrations
|
|
{{- if .Values.thirdParty.stripe.enabled }}
|
|
- name: STRIPE_PUBLIC_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-stripe-secret
|
|
key: public-key
|
|
- name: STRIPE_SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-stripe-secret
|
|
key: secret-key
|
|
- name: STRIPE_TEST_PUBLIC_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-stripe-secret
|
|
key: test-public-key
|
|
- name: STRIPE_TEST_SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-stripe-secret
|
|
key: test-secret-key
|
|
{{- end }}
|
|
{{- if .Values.thirdParty.moneris.enabled }}
|
|
- name: MONERIS_MERCHANT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-moneris-secret
|
|
key: merchant-id
|
|
- name: MONERIS_STORE_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-moneris-secret
|
|
key: store-id
|
|
- name: MONERIS_HT_PROFILE_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-moneris-secret
|
|
key: ht-profile-id
|
|
- name: MONERIS_APP_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-moneris-secret
|
|
key: app-id
|
|
- name: MONERIS_APP_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-moneris-secret
|
|
key: app-secret
|
|
- name: MONERIS_TEST_MERCHANT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-moneris-secret
|
|
key: test-merchant-id
|
|
- name: MONERIS_TEST_STORE_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-moneris-secret
|
|
key: test-store-id
|
|
- name: MONERIS_TEST_HT_PROFILE_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-moneris-secret
|
|
key: test-ht-profile-id
|
|
- name: MONERIS_TEST_APP_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-moneris-secret
|
|
key: test-app-id
|
|
- name: MONERIS_TEST_APP_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-moneris-secret
|
|
key: test-app-secret
|
|
{{- end }}
|
|
# Logging Sidecar related environment variables
|
|
{{- if .Values.loggingSidecar.enabled }}
|
|
- name: LOGGING_SIDE_CAR_PORT
|
|
value: {{ .Values.loggingSidecar.port | quote }}
|
|
{{- end }}
|
|
# Due to subtleties related to how the entrypoint scripts detects how/when to proceed
|
|
# This environment variable indicates if the entrypoint should wait for a restore to complete
|
|
{{- if ne .Values.container.restoreFromBackup "" }}
|
|
- name: RESTORE_FROM_BACKUP
|
|
value: {{ .Values.container.restoreFromBackup | quote }}
|
|
{{- end }}
|
|
{{- if .Values.vault.create.enabled }}
|
|
volumeMounts:
|
|
# Mount for a shared volume for app's vault credentials
|
|
# Note, this is required because the credentials are created as part of the vault's setup and not known ahead of time
|
|
# This seems a better approach than passing, as an example, a preset root token as an environment variable for a few reasons:
|
|
# 1. This way even if the app's credentials become compromised their more limited in scope/permissions
|
|
# 2. This creates a semi-unintentional wait lock for the app until the vault is ready (and the credentials are created)
|
|
- name: role-vars
|
|
mountPath: /role_vars
|
|
readOnly: true
|
|
{{- end }}
|
|
# Logging sidecar for sending logs to a log aggregator
|
|
{{- if .Values.loggingSidecar.enabled }}
|
|
- name: {{ .Values.loggingSidecar.name }}
|
|
image: {{ .Values.loggingSidecar.image.repository }}:{{ .Values.loggingSidecar.image.tag }}
|
|
imagePullPolicy: {{ .Values.loggingSidecar.image.pullPolicy }}
|
|
ports:
|
|
- containerPort: {{ .Values.loggingSidecar.port }}
|
|
env:
|
|
- name: PORT
|
|
value: {{ .Values.loggingSidecar.port | quote }}
|
|
# Log aggregator (OpenObserve) auth variables
|
|
- name: LOGGER_AUTH_USERNAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-logging-sidecar-credentials
|
|
key: username
|
|
- name: LOGGER_AUTH_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-logging-sidecar-password
|
|
key: password
|
|
{{- end }}
|
|
# Backup sidecar for backing up service data
|
|
{{- if .Values.backupSidecar.enabled }}
|
|
- name: {{ .Values.backupSidecar.name }}
|
|
image: {{ .Values.backupSidecar.image.repository }}:{{ .Values.backupSidecar.image.tag }}
|
|
imagePullPolicy: {{ .Values.backupSidecar.image.pullPolicy }}
|
|
ports:
|
|
- containerPort: {{ .Values.backupSidecar.port }}
|
|
env:
|
|
# Release name (used to identify the service/release the backups came from in remote storage)
|
|
- name: RELEASE_NAME
|
|
value: {{ .Release.Name }}
|
|
# Database related environment variables
|
|
- name: DB_HOST
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-db-credentials
|
|
key: db-host
|
|
- name: DB_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-db-credentials
|
|
key: db-name
|
|
- name: DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-db-password
|
|
key: password
|
|
- name: DB_PORT
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-db-credentials
|
|
key: db-port
|
|
- name: DB_USER
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-db-credentials
|
|
key: db-user
|
|
{{- if .Values.vault.create.snapshotServer.enabled }}
|
|
- name: VAULT_NAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-pass-vault-secret
|
|
key: vault-name
|
|
- name: VAULT_SNAPSHOT_SERVER_PORT
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-vault-snapshot-config
|
|
key: port
|
|
{{- end }}
|
|
# NoSQL storage related environment variables
|
|
# Note, we only worry about self-hosted options as cloud-based should have their own backups etc...
|
|
{{- if eq .Values.nosql.type "mongodb" }}
|
|
- name: STORAGE_ACCOUNT_CONNECTION_STRING
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-mongo-credentials
|
|
key: connection-string
|
|
{{- end }}
|
|
# Redis related environment variables
|
|
# Redis is used for BullMQ, which is how we schedule backups
|
|
# We use this instead of, for instance cron jobs, as it lets us deal with failures
|
|
- name: REDIS_HOSTNAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-cache-configmap
|
|
key: hostname
|
|
- name: REDIS_PORT
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ .Release.Name }}-cache-configmap
|
|
key: port
|
|
- name: REDIS_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-cache-credentials
|
|
key: password
|
|
{{- if .Values.passVault.create.snapshotServer.enabled }}
|
|
volumeMounts:
|
|
# Mount for a shared volume for Vault credentials
|
|
# This is separate from the app's `role vars` volume because it includes other credentials
|
|
# In particular, the unseal keys which we require when/if we restore from the backup
|
|
# This volume is also read-only where the `role-vars` is read-write (see description below for why)
|
|
- name: creds
|
|
mountPath: /vault-creds
|
|
readOnly: true
|
|
# Mount for a shared volume for the Vault's role variables for the app
|
|
# This is required by the backup sidecar because if a restart of the app occurs AFTER a vault has been reset (ex. vault using a different container instance),
|
|
# despite the vault data being restored the app would receive incorrect credentials (because this is ONLY written during setup of the vault)
|
|
# The backup sidecar mitigates this by doing it's own write (to overwrite) once it's done a restore
|
|
- name: role-vars
|
|
mountPath: /role_vars
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.vault.create.enabled }}
|
|
volumes:
|
|
- name: role-vars
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Release.Name }}-vault-role-vars
|
|
{{- if .Values.vault.create.snapshotServer.enabled }}
|
|
- name: creds
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Release.Name }}-vault-creds
|
|
{{- end }}
|
|
{{- end }}
|