# --------------------------
# Persistent Volume Claims
# --------------------------
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ccm-data
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 5Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: es-data
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 20Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: es-snapshots
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 10Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: monitor-data
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 5Gi

# --------------------------
# CCM
# --------------------------
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ccm
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ccm
  template:
    metadata:
      labels:
        app: ccm
    spec:
      containers:
        - name: ccm
          image: registry.frafos.net/abc/ccm:5.6
          ports:
            - containerPort: 443
            - containerPort: 444
          resources:
            limits:
              memory: "512Mi"
              cpu: "500m"
            requests:
              memory: "256Mi"
              cpu: "250m"
          volumeMounts:
            - name: ccm-storage
              mountPath: /data
          securityContext:
            capabilities:
              add: ["AUDIT_CONTROL", "AUDIT_WRITE"]
            privileged: true
      restartPolicy: Always
      volumes:
        - name: ccm-storage
          persistentVolumeClaim:
            claimName: ccm-data
---
apiVersion: v1
kind: Service
metadata:
  name: ccm
spec:
  selector:
    app: ccm
  ports:
    - name: https
      port: 443
      targetPort: 443
    - name: https2
      port: 444
      targetPort: 444
  type: ClusterIP

# --------------------------
# Elasticsearch
# --------------------------
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: elastic
spec:
  replicas: 1
  selector:
    matchLabels:
      app: elastic
  template:
    metadata:
      labels:
        app: elastic
    spec:
      containers:
        - name: elastic
          image: docker.elastic.co/elasticsearch/elasticsearch:9.1.5
          ports:
            - containerPort: 9200
            - containerPort: 9300
          env:
            - name: discovery.type
              value: "single-node"
            - name: network.host
              value: "_local_,_site_"
            - name: path.repo
              value: "/usr/share/elasticsearch/snapshots"
            - name: xpack.ml.enabled
              value: "false"
            #- name: thread_pool.search.queue_size  # (optional) Increase search queue size
            #  value: "10000"
            #- name: http.max_initial_line_length   # (optional) Increase max HTTP header size
            #  value: "16kb"
            #- name: cluster.max_shards_per_node    # (optional) Increase max shards
            #  value: "166"
            #- name: indices.lifecycle.history_index_enabled  # (optional) Disable ILM history
            #  value: "false"

            # 1. FOR PLAIN HTTP USE THE FOLLOWING VARIABLES -----
            - name: xpack.security.enabled
              value: "false"
            - name: xpack.security.http.ssl.enabled
              value: "false"
            # 1.2 OR ENABLE SECURITY --- (default user = elastic) ---
            #- name: xpack.security.enabled
            #  value: "true"
            #- name: ELASTIC_PASSWORD  # curl -u elastic:Test1234 http://localhost:9200/
            #  value: "Test1234"

            # 2. FOR SSL USE THE FOLLOWING VARIABLES -------------
            #- name: xpack.security.enabled
            #  value: "true"
            #- name: xpack.security.http.ssl.enabled
            #  value: "true"
            #- name: xpack.security.http.ssl.certificate
            #  value: "certs/server.crt"
            #- name: xpack.security.http.ssl.key
            #  value: "certs/server.key"
            #- name: xpack.security.transport.ssl.enabled
            #  value: "true"
            #- name: xpack.security.transport.ssl.certificate
            #  value: "certs/server.crt"
            #- name: xpack.security.transport.ssl.key
            #  value: "certs/server.key"
            #- name: xpack.security.transport.ssl.verification_mode
            #  value: "certificate"
            #- name: xpack.security.transport.ssl.certificate_authorities
            #  value: "certs/ca.crt"
            # 2.2 --- ANONYMOUS AUTH --- (not recommended for production)
            #- name: xpack.security.authc.anonymous.username
            #  value: "anonymous"
            #- name: xpack.security.authc.anonymous.roles
            #  value: "superuser"
            #- name: xpack.security.authc.anonymous.authz_exception
            #  value: "false"
            # 2.3 --- OR ---
            #- name: ELASTIC_PASSWORD  # curl --cacert ./path/to/certs/ca.crt -u elastic:Test1234 https://localhost:9200/
            #  value: "Test1234"
          resources:
            limits:
              memory: "4Gi"
              cpu: "1000m"
            requests:
              memory: "2Gi"
              cpu: "500m"
          volumeMounts:
            - name: es-data
              mountPath: /usr/share/elasticsearch/data
            - name: es-snapshots
              mountPath: /usr/share/elasticsearch/snapshots
            #- name: es-certs  # (optional) Mount certificates for SSL
            #  mountPath: /usr/share/elasticsearch/config/certs
            #  readOnly: true
      volumes:
        - name: es-data
          persistentVolumeClaim:
            claimName: es-data
        - name: es-snapshots
          persistentVolumeClaim:
            claimName: es-snapshots
        #- name: es-certs  # (optional) Secret or ConfigMap containing certs
        #  secret:
        #    secretName: es-certs
      restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: elastic
spec:
  selector:
    app: elastic
  ports:
    - name: http
      port: 9200
      targetPort: 9200
    - name: transport
      port: 9300
      targetPort: 9300

# --------------------------
# Chrome
# --------------------------
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: chrome
spec:
  replicas: 1
  selector:
    matchLabels:
      app: chrome
  template:
    metadata:
      labels:
        app: chrome
    spec:
      containers:
        - name: chrome
          image: zenika/alpine-chrome:124
          args:
            - "--no-sandbox"
            - "--remote-debugging-address=::"
            - "--remote-debugging-port=9222"
          ports:
            - containerPort: 9222
          resources:
            limits:
              memory: "512Mi"
              cpu: "500m"
            requests:
              memory: "128Mi"
              cpu: "100m"
      restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: chrome
spec:
  selector:
    app: chrome
  ports:
    - name: debug
      port: 9222
      targetPort: 9222

# --------------------------
# MONITOR
# --------------------------
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: monitor
spec:
  replicas: 1
  selector:
    matchLabels:
      app: monitor
  template:
    metadata:
      labels:
        app: monitor
    spec:
      containers:
        - name: monitor
          image: registry.frafos.net/abc/mon:10.2
          securityContext:
            capabilities:
              add: ["NET_BIND_SERVICE"]
          ports:
            - containerPort: 445
            - containerPort: 514
            - containerPort: 5045
            - containerPort: 5044
            - containerPort: 3042
            - containerPort: 873
          env:
            - name: BROWSER_URL
              value: "http://chrome:9222/"
            - name: PDF_RENDER_URL
              value: "http://monitor:445"
            - name: SERVER_PORT
              value: "445"
          volumeMounts:
            - name: monitor-storage
              mountPath: /data
          tty: true
          stdin: true
          resources:
            limits:
              memory: "1.5Gi"
              cpu: "1"
            requests:
              memory: "250Mi"
              cpu: "250m"
          readinessProbe:
            exec:
              command:
                - node
                - -e
                - "fetch('http://localhost:445/').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))"
            initialDelaySeconds: 30
            periodSeconds: 15
            timeoutSeconds: 5
            failureThreshold: 20
          livenessProbe:
            exec:
              command:
                - node
                - -e
                - "fetch('http://localhost:445/').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))"
            initialDelaySeconds: 30
            periodSeconds: 15
            timeoutSeconds: 5
            failureThreshold: 20
      restartPolicy: Always
      volumes:
        - name: monitor-storage
          persistentVolumeClaim:
            claimName: monitor-data
---
apiVersion: v1
kind: Service
metadata:
  name: monitor
spec:
  selector:
    app: monitor
  ports:
    - name: server
      port: 445
      targetPort: 445
    - name: vector-syslog-port
      port: 514
      targetPort: 514
    - name: vector-socket-port
      port: 5044
      targetPort: 5044
    - name: vector-socket-tls-port
      port: 5045
      targetPort: 5045
    - name: upload-api
      port: 3042
      targetPort: 3042
    - name: upload-rsync
      port: 873
      targetPort: 873

# --------------------------
# Redis
# --------------------------
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
    spec:
      containers:
        - name: redis
          image: registry.frafos.net/fril/redis-stack-server:latest
          ports:
            - containerPort: 6379
          securityContext:
            capabilities:
              drop: ["MKNOD", "NET_RAW", "AUDIT_WRITE"]
          livenessProbe:
            exec:
              command: ["redis-cli", "ping"]
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            limits:
              memory: "1Gi"
              cpu: "500m"
            requests:
              memory: "512Mi"
              cpu: "250m"
      restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: redis
spec:
  selector:
    app: redis
  ports:
    - name: redis
      port: 6379
      targetPort: 6379

# --------------------------
# Alerts
# --------------------------
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: alerts
spec:
  replicas: 1
  selector:
    matchLabels:
      app: alerts
  template:
    metadata:
      labels:
        app: alerts
    spec:
      containers:
        - name: alerts
          image: registry.frafos.net/fril/alerts:10.2
          ports:
            - containerPort: 80
          env:
            - name: REDIS_HOST
              value: "redis"
            - name: elasticConfigUrl
              value: "http://elastic:9200/"
          securityContext:
            capabilities:
              add: ["AUDIT_CONTROL", "NET_RAW", "AUDIT_WRITE"]
          readinessProbe:
            httpGet:
              path: /api/alertapi/help
              port: 80
            initialDelaySeconds: 15
            periodSeconds: 15
            timeoutSeconds: 5
            failureThreshold: 20
          resources:
            limits:
              memory: "1Gi"
              cpu: "500m"
            requests:
              memory: "512Mi"
              cpu: "250m"
      restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: alerts
spec:
  selector:
    app: alerts
  ports:
    - name: http
      port: 80
      targetPort: 80

# --------------------------
# rq2rest
# --------------------------
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: rq2rest
spec:
  replicas: 1
  selector:
    matchLabels:
      app: rq2rest
  template:
    metadata:
      labels:
        app: rq2rest
    spec:
      containers:
        - name: rq2rest
          image: registry.frafos.net/fril/rq2rest:latest
          command:
            - "/bin/sh"
            - "-c"
            - >
              rq2rest -c /etc/rq2rest.ini -d 5
              --redis_url=redis:6379
              --http_url=http://alerts:80/ingestion/http/00000000-0000-0000-0000-000000000000
          tty: true
          resources:
            limits:
              memory: "1Gi"
              cpu: "500m"
            requests:
              memory: "512Mi"
              cpu: "250m"
      restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: rq2rest
spec:
  selector:
    app: rq2rest
  ports:
    - name: rq
      port: 8080
      targetPort: 8080
