deployment.yaml

# Copyright (c) 2025, NVIDIA CORPORATION.  All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "event-exporter.fullname" . }}
  labels:
    {{- include "event-exporter.labels" . | nindent 4 }}
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "event-exporter.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      annotations:
        # Force pod restart when configmap changes
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        {{- with .Values.podAnnotations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      labels:
        {{- include "event-exporter.labels" . | nindent 8 }}
    spec:
      {{- with .Values.global.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "event-exporter.fullname" . }}
      {{- if and .Values.global.datastore (eq .Values.global.datastore.provider "postgresql") }}
      initContainers:
        - name: fix-cert-permissions
          image: "{{ .Values.global.initContainerImage.repository }}:{{ .Values.global.initContainerImage.tag }}"
          imagePullPolicy: {{ .Values.global.initContainerImage.pullPolicy }}
          securityContext:
            runAsUser: 1001
            runAsGroup: 1001
          command:
            - sh
            - -c
            - |
              echo "Copying PostgreSQL client certificates with correct permissions..."
              cp /etc/ssl/client-certs-original/tls.crt /etc/ssl/client-certs-fixed/
              cp /etc/ssl/client-certs-original/ca.crt /etc/ssl/client-certs-fixed/
              cp /etc/ssl/client-certs-original/tls.key /etc/ssl/client-certs-fixed/
              chmod 644 /etc/ssl/client-certs-fixed/tls.crt
              chmod 644 /etc/ssl/client-certs-fixed/ca.crt
              chmod 600 /etc/ssl/client-certs-fixed/tls.key
              echo "Certificate permissions fixed:"
              ls -la /etc/ssl/client-certs-fixed/
          volumeMounts:
            - name: postgresql-client-cert-original
              mountPath: /etc/ssl/client-certs-original
              readOnly: true
            - name: client-certs-fixed
              mountPath: /etc/ssl/client-certs-fixed
      {{- end }}
      containers:
        - name: event-exporter
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default ((.Values.global).image).tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          {{- if and .Values.global.datastore (eq .Values.global.datastore.provider "postgresql") }}
          securityContext:
            runAsUser: 1001
            runAsGroup: 1001
          {{- else }}
          securityContext:
            runAsUser: 0
          {{- end }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          args:
          - "--config=/etc/config/config.toml"
          - "--metrics-port={{ .Values.global.metricsPort }}"
          - "--oidc-secret-path=/var/secrets/oidc-client-secret"
          - "--workers={{ .Values.exporter.workers }}"
          ports:
            - name: metrics
              containerPort: {{ .Values.global.metricsPort }}
          livenessProbe:
            httpGet:
              path: /healthz
              port: metrics
            initialDelaySeconds: 15
            periodSeconds: 20
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /healthz
              port: metrics
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 3
          volumeMounts:
          - name: config-volume
            mountPath: /etc/config/config.toml
            subPath: config.toml
          - name: oidc-secret
            mountPath: /var/secrets
            readOnly: true
          {{- if and .Values.global.datastore (eq .Values.global.datastore.provider "postgresql") }}
          - name: client-certs-fixed
            mountPath: /etc/ssl/client-certs
            readOnly: true
          {{- else }}
          - name: mongo-app-client-cert
            mountPath: /etc/ssl/mongo-client
            readOnly: true
          {{- end }}
          - name: var-run-vol
            mountPath: /var/run/
          env:
            # App name for connection identification in logs and currentOp
            - name: APP_NAME
              value: {{ .Chart.Name | quote }}
            {{- if and .Values.global.datastore (eq .Values.global.datastore.provider "postgresql") }}
            - name: POSTGRESQL_CLIENT_CERT_MOUNT_PATH
              value: "/etc/ssl/client-certs"
            {{- else }}
            - name: MONGODB_CLIENT_CERT_PATH
              value: "/etc/ssl/mongo-client/tls.crt"
            - name: MONGODB_CLIENT_KEY_PATH
              value: "/etc/ssl/mongo-client/tls.key"
            - name: MONGODB_CA_CERT_PATH
              value: "/etc/ssl/mongo-client/ca.crt"
            {{- end }}
          envFrom:
            - configMapRef:
                name: {{ if .Values.global.datastore }}{{ .Release.Name }}-datastore-config{{ else }}mongodb-config{{ end }}
                optional: true
      volumes:
      - name: config-volume
        configMap:
          name: {{ include "event-exporter.fullname" . }}
          items:
          - key: config.toml
            path: config.toml
      - name: oidc-secret
        secret:
          secretName: {{ .Values.oidcSecretName }}
          optional: false
      - name: var-run-vol
        hostPath:
          path: /var/run/nvsentinel
          type: DirectoryOrCreate
      {{- if and .Values.global.datastore (eq .Values.global.datastore.provider "postgresql") }}
      - name: postgresql-client-cert-original
        secret:
          secretName: postgresql-client-cert
          optional: false
      - name: client-certs-fixed
        emptyDir: {}
      {{- else }}
      - name: mongo-app-client-cert
        secret:
          secretName: {{ include "nvsentinel.certificates.secretName" . }}
          {{- include "nvsentinel.certificates.volumeItems" . | nindent 10 }}
          optional: true
      {{- end }}
      restartPolicy: Always
      {{- with (.Values.global.systemNodeSelector | default .Values.nodeSelector) }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with (.Values.global.affinity | default .Values.affinity) }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with (.Values.global.systemNodeTolerations | default .Values.tolerations) }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}