apiVersion: v1
kind: Namespace
metadata:
  name: nuthatch-testbed
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: postgres-init
  namespace: nuthatch-testbed
data:
  01-keycloak.sql: |
    CREATE USER keycloak WITH PASSWORD 'synthetic-keycloak-db';
    CREATE DATABASE keycloak OWNER keycloak;
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
  namespace: nuthatch-testbed
spec:
  replicas: @@POSTGRES_REPLICAS@@
  selector:
    matchLabels: {app: postgres}
  template:
    metadata:
      labels: {app: postgres}
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      containers:
        - name: postgres
          image: @@POSTGRES_IMAGE@@
          imagePullPolicy: Never
          env:
            - {name: POSTGRES_DB, value: nuthatch}
            - {name: POSTGRES_USER, value: nuthatch}
            - {name: POSTGRES_PASSWORD, value: synthetic-postgres}
          ports:
            - {name: postgres, containerPort: 5432}
          readinessProbe:
            exec:
              command: [pg_isready, -U, nuthatch, -d, nuthatch]
            periodSeconds: 2
          resources:
            requests: {cpu: 100m, memory: 256Mi}
            limits: {cpu: "2", memory: 1Gi}
          volumeMounts:
            - {name: data, mountPath: /var/lib/postgresql}
            - {name: init, mountPath: /docker-entrypoint-initdb.d}
      volumes:
        - name: data
          emptyDir: {}
        - name: init
          configMap: {name: postgres-init}
---
apiVersion: v1
kind: Service
metadata:
  name: postgres
  namespace: nuthatch-testbed
spec:
  selector: {app: postgres}
  ports:
    - {name: postgres, port: 5432, targetPort: postgres}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis
  namespace: nuthatch-testbed
spec:
  replicas: @@REDIS_REPLICAS@@
  selector:
    matchLabels: {app: redis}
  template:
    metadata:
      labels: {app: redis}
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      containers:
        - name: redis
          image: @@REDIS_IMAGE@@
          imagePullPolicy: Never
          args: [redis-server, --save, "", --appendonly, "no"]
          ports:
            - {name: redis, containerPort: 6379}
          readinessProbe:
            exec:
              command: [redis-cli, ping]
            periodSeconds: 2
          resources:
            requests: {cpu: 25m, memory: 32Mi}
            limits: {cpu: "1", memory: 256Mi}
---
apiVersion: v1
kind: Service
metadata:
  name: redis
  namespace: nuthatch-testbed
spec:
  selector: {app: redis}
  ports:
    - {name: redis, port: 6379, targetPort: redis}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dragonfly
  namespace: nuthatch-testbed
spec:
  replicas: @@DRAGONFLY_REPLICAS@@
  selector:
    matchLabels: {app: dragonfly}
  template:
    metadata:
      labels: {app: dragonfly}
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      containers:
        - name: dragonfly
          image: @@DRAGONFLY_IMAGE@@
          imagePullPolicy: Never
          args: [--proactor_threads=1, --maxmemory=256mb]
          ports:
            - {name: redis, containerPort: 6379}
          readinessProbe:
            tcpSocket: {port: redis}
            periodSeconds: 2
          resources:
            requests: {cpu: 100m, memory: 64Mi}
            limits: {cpu: "2", memory: 384Mi}
---
apiVersion: v1
kind: Service
metadata:
  name: dragonfly
  namespace: nuthatch-testbed
spec:
  selector: {app: dragonfly}
  ports:
    - {name: redis, port: 6379, targetPort: redis}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  namespace: nuthatch-testbed
spec:
  replicas: @@KEYCLOAK_REPLICAS@@
  selector:
    matchLabels: {app: keycloak}
  template:
    metadata:
      labels: {app: keycloak}
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      containers:
        - name: keycloak
          image: @@KEYCLOAK_IMAGE@@
          imagePullPolicy: Never
          args: [start-dev, --hostname=http://keycloak.nuthatch.test:8080]
          env:
            - {name: KC_BOOTSTRAP_ADMIN_USERNAME, value: nuthatch-admin}
            - {name: KC_BOOTSTRAP_ADMIN_PASSWORD, value: synthetic-keycloak}
            - {name: KC_DB, value: postgres}
            - {name: KC_DB_URL, value: jdbc:postgresql://postgres:5432/keycloak}
            - {name: KC_DB_USERNAME, value: keycloak}
            - {name: KC_DB_PASSWORD, value: synthetic-keycloak-db}
            - {name: JAVA_OPTS_KC_HEAP, value: "-XX:MinHeapFreeRatio=10 -XX:MaxHeapFreeRatio=30 -XX:MaxRAMPercentage=65"}
          ports:
            - {name: http, containerPort: 8080}
          readinessProbe:
            httpGet: {path: /realms/master, port: http}
            periodSeconds: 3
            failureThreshold: 60
          resources:
            requests: {cpu: 200m, memory: 512Mi}
            limits: {cpu: "2", memory: 1Gi}
---
apiVersion: v1
kind: Service
metadata:
  name: keycloak
  namespace: nuthatch-testbed
spec:
  clusterIP: 10.96.0.55
  selector: {app: keycloak}
  ports:
    - {name: http, port: 8080, targetPort: http}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: zitadel
  namespace: nuthatch-testbed
spec:
  replicas: @@ZITADEL_REPLICAS@@
  selector:
    matchLabels: {app: zitadel}
  template:
    metadata:
      labels: {app: zitadel}
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      volumes:
        - name: bootstrap
          emptyDir: {}
      containers:
        - name: zitadel
          image: @@ZITADEL_IMAGE@@
          imagePullPolicy: Never
          args: [start-from-init, --masterkeyFromEnv, --tlsMode, disabled]
          env:
            - {name: ZITADEL_MASTERKEY, value: synthetic-masterkey-32-character}
            - {name: ZITADEL_DATABASE_POSTGRES_DSN, value: "postgresql://nuthatch:synthetic-postgres@postgres:5432/postgres?sslmode=disable"}
            - {name: ZITADEL_EXTERNALSECURE, value: "false"}
            - {name: ZITADEL_EXTERNALDOMAIN, value: zitadel.nuthatch.test}
            - {name: ZITADEL_EXTERNALPORT, value: "8080"}
            - {name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME, value: nuthatch-admin}
            - {name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD, value: Synthetic-Zitadel-1!}
            - {name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED, value: "false"}
            - {name: ZITADEL_FIRSTINSTANCE_PATPATH, value: /bootstrap/admin.pat}
            - {name: ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME, value: nuthatch-provisioner}
            - {name: ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME, value: Nuthatch Provisioner}
            - {name: ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE, value: "2036-01-01T00:00:00Z"}
            - {name: ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH, value: /bootstrap/login-client.pat}
            - {name: ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME, value: nuthatch-login-client}
            - {name: ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME, value: Nuthatch Login Client}
            - {name: ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE, value: "2036-01-01T00:00:00Z"}
            - {name: ZITADEL_DEFAULTINSTANCE_OIDCSETTINGS_ACCESSTOKENLIFETIME, value: 5m}
            - {name: ZITADEL_DEFAULTINSTANCE_OIDCSETTINGS_IDTOKENLIFETIME, value: 5m}
            - {name: ZITADEL_DEFAULTINSTANCE_OIDCSETTINGS_REFRESHTOKENIDLEEXPIRATION, value: 1h}
            - {name: ZITADEL_DEFAULTINSTANCE_OIDCSETTINGS_REFRESHTOKENEXPIRATION, value: 2h}
          volumeMounts:
            - {name: bootstrap, mountPath: /bootstrap}
          ports:
            - {name: http, containerPort: 8080}
          readinessProbe:
            httpGet:
              path: /.well-known/openid-configuration
              port: http
              httpHeaders:
                - {name: Host, value: zitadel.nuthatch.test}
            periodSeconds: 3
            failureThreshold: 80
          resources:
            requests: {cpu: 200m, memory: 512Mi}
            limits: {cpu: "2", memory: 1Gi}
        - name: oidc-provisioner
          image: @@CURL_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              while [ ! -s /bootstrap/admin.pat ] || [ ! -s /bootstrap/login-client.pat ]; do
                sleep 1
              done
              exec sleep 2147483647
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: {drop: ["ALL"]}
            runAsUser: 0
          volumeMounts:
            - {name: bootstrap, mountPath: /bootstrap, readOnly: true}
          resources:
            requests: {cpu: 10m, memory: 16Mi}
            limits: {cpu: 100m, memory: 32Mi}
---
apiVersion: v1
kind: Service
metadata:
  name: zitadel
  namespace: nuthatch-testbed
spec:
  clusterIP: 10.96.0.56
  selector: {app: zitadel}
  ports:
    - {name: http, port: 8080, targetPort: http}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: garage-config
  namespace: nuthatch-testbed
data:
  garage.toml: |
    metadata_dir = "/data/meta"
    data_dir = "/data/data"
    db_engine = "sqlite"
    replication_factor = 1
    rpc_bind_addr = "[::]:3901"
    rpc_public_addr = "127.0.0.1:3901"
    rpc_secret = "0000000000000000000000000000000000000000000000000000000000000000"
    [s3_api]
    s3_region = "garage"
    api_bind_addr = "[::]:3900"
    root_domain = ".s3.garage.nuthatch.test"
    [admin]
    api_bind_addr = "[::]:3903"
    admin_token = "synthetic-garage-admin"
    metrics_token = "synthetic-garage-metrics"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: garage
  namespace: nuthatch-testbed
spec:
  replicas: @@GARAGE_REPLICAS@@
  selector:
    matchLabels: {app: garage}
  template:
    metadata:
      labels: {app: garage}
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      containers:
        - name: garage
          image: @@GARAGE_IMAGE@@
          imagePullPolicy: Never
          command: [/garage]
          args: [server, --single-node, --default-bucket]
          env:
            - {name: GARAGE_DEFAULT_ACCESS_KEY, value: GK00000000000000000000000000000000}
            - {name: GARAGE_DEFAULT_SECRET_KEY, value: "0000000000000000000000000000000000000000000000000000000000000000"}
            - {name: GARAGE_DEFAULT_BUCKET, value: nuthatch-fixture}
          ports:
            - {name: s3, containerPort: 3900}
          resources:
            requests: {cpu: 100m, memory: 128Mi}
            limits: {cpu: "2", memory: 512Mi}
          volumeMounts:
            - {name: config, mountPath: /etc/garage.toml, subPath: garage.toml}
            - {name: data, mountPath: /data}
        - name: s3-readiness
          image: @@AWS_CLI_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args: ["while :; do sleep 3600; done"]
          env:
            - {name: AWS_ACCESS_KEY_ID, value: GK00000000000000000000000000000000}
            - {name: AWS_SECRET_ACCESS_KEY, value: "0000000000000000000000000000000000000000000000000000000000000000"}
            - {name: AWS_DEFAULT_REGION, value: garage}
          readinessProbe:
            exec:
              command: [aws, --endpoint-url, "http://127.0.0.1:3900", s3api, head-bucket, --bucket, nuthatch-fixture]
            periodSeconds: 2
            failureThreshold: 60
          resources:
            requests: {cpu: 25m, memory: 64Mi}
            limits: {cpu: "1", memory: 256Mi}
      volumes:
        - name: config
          configMap: {name: garage-config}
        - name: data
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: garage
  namespace: nuthatch-testbed
spec:
  selector: {app: garage}
  ports:
    - {name: s3, port: 3900, targetPort: s3}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: versitygw
  namespace: nuthatch-testbed
spec:
  replicas: @@VERSITYGW_REPLICAS@@
  selector:
    matchLabels: {app: versitygw}
  template:
    metadata:
      labels: {app: versitygw}
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      containers:
        - name: versitygw
          image: @@VERSITYGW_IMAGE@@
          imagePullPolicy: Never
          args: [--port, ":10000", --admin-port, "127.0.0.1:10001", --iam-dir, /data, posix, --versioning-dir, /versions, /data]
          env:
            - {name: ROOT_ACCESS_KEY, value: synthetic-s3-access}
            - {name: ROOT_SECRET_KEY, value: synthetic-s3-secret}
            - {name: ADMIN_ACCESS_KEY_ID, value: synthetic-s3-access}
            - {name: ADMIN_SECRET_ACCESS_KEY, value: synthetic-s3-secret}
          ports:
            - {name: s3, containerPort: 10000}
          resources:
            requests: {cpu: 100m, memory: 64Mi}
            limits: {cpu: "2", memory: 512Mi}
          volumeMounts:
            - {name: data, mountPath: /data}
            - {name: versions, mountPath: /versions}
        - name: s3-readiness
          image: @@AWS_CLI_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args: ["while :; do sleep 3600; done"]
          env:
            - {name: AWS_ACCESS_KEY_ID, value: synthetic-s3-access}
            - {name: AWS_SECRET_ACCESS_KEY, value: synthetic-s3-secret}
            - {name: AWS_DEFAULT_REGION, value: us-east-1}
          readinessProbe:
            exec:
              command: [aws, --endpoint-url, "http://127.0.0.1:10000", s3api, list-buckets]
            periodSeconds: 2
            failureThreshold: 60
          resources:
            requests: {cpu: 25m, memory: 64Mi}
            limits: {cpu: "1", memory: 256Mi}
      volumes:
        - name: data
          emptyDir: {}
        - name: versions
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: versitygw
  namespace: nuthatch-testbed
spec:
  selector: {app: versitygw}
  ports:
    - {name: s3, port: 10000, targetPort: s3}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: controlled-dns
  namespace: nuthatch-testbed
data:
  Corefile: |
    .:53 {
      errors
      hosts {
        10.96.0.55 keycloak.nuthatch.test
        10.96.0.56 zitadel.nuthatch.test
        fallthrough
      }
      forward . 10.96.0.10
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: controlled-dns
  namespace: nuthatch-testbed
spec:
  replicas: @@COREDNS_REPLICAS@@
  selector:
    matchLabels: {app: controlled-dns}
  template:
    metadata:
      labels: {app: controlled-dns}
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      containers:
        - name: coredns
          image: @@COREDNS_IMAGE@@
          imagePullPolicy: Never
          args: [-conf, /etc/coredns/Corefile]
          ports:
            - {name: dns-udp, containerPort: 53, protocol: UDP}
            - {name: dns-tcp, containerPort: 53, protocol: TCP}
          readinessProbe:
            tcpSocket: {port: dns-tcp}
            periodSeconds: 2
          resources:
            requests: {cpu: 25m, memory: 32Mi}
            limits: {cpu: "1", memory: 128Mi}
          volumeMounts:
            - {name: config, mountPath: /etc/coredns}
      volumes:
        - name: config
          configMap: {name: controlled-dns}
---
apiVersion: v1
kind: Service
metadata:
  name: controlled-dns
  namespace: nuthatch-testbed
spec:
  clusterIP: 10.96.0.53
  selector: {app: controlled-dns}
  ports:
    - {name: dns-udp, port: 53, targetPort: dns-udp, protocol: UDP}
    - {name: dns-tcp, port: 53, targetPort: dns-tcp, protocol: TCP}