prime-app-template.yml

---
apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: prime
  description: >-
    Deployment template for the Ministry of Health PharmaNet Revisions for Information Management Enhancements
parameters:
- name: SVC_NAME
  displayName: Name
  description: A name appended to all objects
  required: true
  value: prime
- name: IMAGE_TAG
  displayName: Image Tag
  description: an identifier that labels which version an image belongs to.
  required: true
- name: OC_LICENSE_PLATE
  displayName: OpenShift License Plate
  description: Prepends your dev/test/prod URL
  required: true
  value: 9c33a9
- name: OC_ENV
  displayName: Openshift Environment
  description: dev/test/prod
  required: true
- name: FRONTEND_REPLICAS
  displayName: Number of frontend pods
  description: For scaling frontend pods
  required: true
  value: '3'
- name: BACKEND_REPLICAS
  displayName: Number of backend pods
  description: For scaling backend pods
  required: true
  value: '3'
- name: VANITY_URL
  displayName: Vanity URL
  description: Minus the HTTP/HTTPS, this is your vanity URL or the prefix of your default URL
  required: true
  value: vanity
- name: ASP_ENV
  displayName: ASP.NET Environment
  description: Development or Production
  required: true
  value: Development
- name: WEB_PORT
  displayName: Web Port for NGINX
  description: Termination port on NGINX (8080 or 8443)
  value: "8080"
- name: URL_STUB
  displayName: URL Stub
  description: Appended to all URLs, used in PRs
  value: "-9c33a9-dev.apps.silver.devops.gov.bc.ca"
  required: false
- name: HPR_URL
  displayName: Health Practicioner URL
  value: ""
- name: MAUTH_URL
  displayName: MUTUAL_AUTHENTICATION URL
  value: ""
- name: CRON_SCHEDULE_RENEWALS
  description: 'Renewal email sending cron schedule. Cron-like schedule expression. Default: Once a day at 11 PM'
  value: '0 23 * * *'
- name: CRON_SCHEDULE_STATUSES
  description: 'Email status update cron job. Cron-like schedule expression. Default: At minute 0 past every 6th hour.'
  value: '0 */6 * * *'
objects:
###########################################
###               Frontend              ###
###########################################
#   Frontend Deployment
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: ${SVC_NAME}-frontend
    namespace: ${OC_LICENSE_PLATE}-${OC_ENV}
    annotations:
      image.openshift.io/triggers: |-
        [
          {
            "from": {
              "kind": "ImageStreamTag",
              "namespace": "9c33a9-tools",
              "name": "prime-frontend:${IMAGE_TAG}"
            },
            "fieldPath": "spec.template.spec.containers[0].image",
            "paused": false
          }
        ]
    labels:
      app.kubernetes.io/instance: ${SVC_NAME}
      app.kubernetes.io/name: frontend
      app.kubernetes.io/version: 0.0.1
      app.openshift.io/runtime: nginx
  spec:
    replicas: ${{FRONTEND_REPLICAS}}
    selector:
      matchLabels:
        app.kubernetes.io/instance: ${SVC_NAME}
        app.kubernetes.io/name: frontend
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: ${SVC_NAME}
          app.kubernetes.io/name: frontend
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 1
                podAffinityTerm:
                  labelSelector:
                    matchExpressions:
                      - key: app.kubernetes.io/name
                        operator: In
                        values:
                          - frontend
                      - key: app.kubernetes.io/instance
                        operator: In
                        values:
                          - ${SVC_NAME}
                  topologyKey: kubernetes.io/hostname
        volumes:
          - name: vanity-tls-certs
            secret:
              secretName: vanity-tls-certificate
              defaultMode: 420
          - name: nginx-config
            configMap:
              name: ${SVC_NAME}-nginx-config
          - name: plr-integration-volume
            secret:
              secretName: plr-integration
          - name: env-config
            configMap:
              name: ${SVC_NAME}-env-config
          - name: log-storage
            emptyDir: {}
          - name: fluentbit-config
            configMap:
              name: frontend-fluentbit-config
        containers:
          - name: ${SVC_NAME}-frontend
            image: >-
              image-registry.openshift-image-registry.svc:5000/${OC_LICENSE_PLATE}-tools/prime-frontend:${IMAGE_TAG}
            ports:
              - containerPort: 80
                protocol: TCP
              - containerPort: 8080
                protocol: TCP
              - containerPort: 8443
                protocol: TCP
              - containerPort: 8888
                protocol: TCP
              - containerPort: 8890
                protocol: TCP
            volumeMounts:
            - name: vanity-tls-certs
              readOnly: true
              mountPath: /etc/nginx/certs
            - name: plr-integration-volume
              readOnly: true
              mountPath: /etc/nginx/certs/plr
            - name: nginx-config
              readOnly: true
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
            - name: env-config
              readOnly: true
              mountPath: /opt/app-root/src/assets/config-map.json
              subPath: config-map.json
            - name: log-storage
              mountPath: /tmp/
            resources: {}
            envFrom:
              - configMapRef:
                  name: keycloak
            env:
              - name: DOCUMENT_MANAGER_URL
                value: https://${VANITY_URL}/api/docman
              - name: SERVER_LOGFILE
                value: /tmp/error_fluentbit.log
            readinessProbe:
              httpGet:
                path: /
                port: 8080
              initialDelaySeconds: 5
              periodSeconds: 5
            livenessProbe:
              httpGet:
                path: /
                port: 8080
              initialDelaySeconds: 5
              failureThreshold: 1
              periodSeconds: 5
          - name: fluent-bit
            image: 'docker.io/fluent/fluent-bit:3.0.3'
            imagePullPolicy: IfNotPresent
            resources:
              requests:
                cpu: 10m
                memory: 16Mi
            readinessProbe:
              httpGet:
                path: /
                port: 2020
                scheme: HTTP
              initialDelaySeconds: 10
              timeoutSeconds: 1
              periodSeconds: 60
              successThreshold: 1
              failureThreshold: 3
            livenessProbe:
              httpGet:
                path: /
                port: 2020
                scheme: HTTP
              initialDelaySeconds: 10
              timeoutSeconds: 1
              periodSeconds: 60
              successThreshold: 1
              failureThreshold: 3
            env:
              - name: SERVER_LOGFILE
                value: /tmp/error_fluentbit.log
            ports:
              - name: metrics
                containerPort: 2020
                protocol: TCP
              - name: http-plugin
                containerPort: 80
                protocol: TCP
            volumeMounts:
              - name: fluentbit-config
                mountPath: /fluent-bit/etc
              - name: log-storage
                mountPath: /tmp/
            terminationMessagePolicy: File
    strategy:
      type: RollingUpdate
      rollingUpdate:
        maxSurge: 25%
        maxUnavailable: 25%
    revisionHistoryLimit: 10
    progressDeadlineSeconds: 600
    
#   NGINX Configuration
- apiVersion: v1
  kind: ConfigMap
  metadata:
    name: ${SVC_NAME}-nginx-config
    namespace: ${OC_LICENSE_PLATE}-${OC_ENV}
    labels:
      app.kubernetes.io/part-of: ${SVC_NAME}
  data:
    nginx.conf: |-
      # Based on https://www.nginx.com/resources/wiki/start/topics/examples/full/#nginx-conf
      #user              www www;  ## Default: nobody

      worker_processes  auto;
      error_log         "/var/log/nginx/error.log";
      error_log         "/tmp/error_fluentbit.log";
      pid               "/tmp/nginx.pid";

      events {
          worker_connections  1024;
      }

      http {
          include       /etc/nginx/mime.types;
          default_type  application/octet-stream;
          log_format    main '$remote_addr - $remote_user [$time_local] '
                            '"$request" $status  $body_bytes_sent "$http_referer" '
                            '"$http_user_agent" "$http_x_forwarded_for"';
          access_log    "/var/log/nginx/access.log" main;
          # add_header    X-Frame-Options SAMEORIGIN;

          client_body_temp_path  "/tmp/client_body" 1 2;
          proxy_temp_path        "/tmp/proxy" 1 2;
          fastcgi_temp_path      "/tmp/fastcgi" 1 2;
          scgi_temp_path         "/tmp/scgi" 1 2;
          uwsgi_temp_path        "/tmp/uwsgi" 1 2;

          sendfile           on;
          # tcp_nopush         on;
          tcp_nodelay        off;
          gzip               on;
          gzip_http_version  1.0;
          gzip_comp_level    2;
          gzip_proxied       any;
          gzip_types         text/plain text/css application/javascript text/xml application/xml+rss;
          keepalive_timeout  65;
          ssl_protocols      TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
          ssl_ciphers        HIGH:!aNULL:!MD5;
          client_max_body_size 80M;
          server_tokens off;

        server {
          listen 8080;
          server_name localhost *.gov.bc.ca;
          server_tokens off;

          root /opt/app-root/src;
          index index.html index.htm;

          include mime.types;
          add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
          add_header X-XSS-Protection "1; mode=block" always;
          add_header Content-Security-Policy "frame-ancestors 'self'  common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
          add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
          add_header X-Content-Type-Options "nosniff" always;
          add_header Referrer-Policy "no-referrer-when-downgrade";

          gzip on;
          gzip_min_length 1000;
          gzip_proxied expired no-cache no-store private auth;
          gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;

          location / {
            try_files $uri $uri/ /index.html$args;
          }
          location /api/docman/ {
            proxy_pass http://${SVC_NAME}-document-manager:6001/;
          }
          location /api/v1/ {
            proxy_pass http://${SVC_NAME}-webapi:8080/api/;
          }
          location /api/v1/PLRHL7 {
            proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
            #        proxy_set_header  X-SSL-CERT $ssl_client_escaped_cert;
          }
          location /nginx_status {
            # Enable Nginx stats
            stub_status on;
            # Only allow access from localhost
            allow 127.0.0.1;
            # Other request should be denied
            deny all;
            # No need to log this request, its just noise
            access_log on;
          }
        }
        server {
          listen 8443 ssl;
          server_name *.gov.bc.ca;
          ssl_password_file certs/passwd.txt;
          ssl_certificate certs/chained.crt;
          ssl_certificate_key certs/private.key;
          server_tokens off;
          #    ssl_verify_client   optional_no_ca;

          root /opt/app-root/src;
          index index.html index.htm;

          add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
          add_header X-XSS-Protection "1; mode=block" always;
          add_header Content-Security-Policy "frame-ancestors 'self'  common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
          add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
          add_header X-Content-Type-Options "nosniff" always;
          add_header Referrer-Policy "no-referrer-when-downgrade";

          gzip on;
          gzip_min_length 1000;
          gzip_proxied expired no-cache no-store private auth;
          gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;

          location / {
            try_files $uri $uri/ /index.html$args;
          }
          location /api/docman/ {
            proxy_pass http://${SVC_NAME}-document-manager:6001/;
          }
          location /api/v1/ {
            proxy_pass http://${SVC_NAME}-webapi:8080/api/;
          }
          location /api/v1/PLRHL7 {
            proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
            #        proxy_set_header  X-SSL-CERT $ssl_client_escaped_cert;
          }
          location /nginx_status {
            # Enable Nginx stats
            stub_status on;

            # Only allow access from localhost
            allow 127.0.0.1;

            # Other request should be denied
            deny all;

            # No need to log this request, its just noise
            access_log on;
          }
        }
        server {
          listen 8888;
          server_name *.gov.bc.ca;
          server_tokens off;

          root /opt/app-root/src;
          index index.html index.htm;

          add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
          add_header X-XSS-Protection "1; mode=block" always;
          add_header Content-Security-Policy "frame-ancestors 'self'  common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
          add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
          add_header X-Content-Type-Options "nosniff" always;
          add_header Referrer-Policy "no-referrer-when-downgrade";
          gzip on;
          gzip_min_length 1000;
          gzip_proxied expired no-cache no-store private auth;
          gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;

          location / {
            try_files $uri $uri/ /index.html$args;
          }
          location /api/docman/ {
            proxy_pass http://${SVC_NAME}-document-manager:6001;
          }
          location /api/v1/ {
            proxy_pass http://${SVC_NAME}-webapi:8080/api/;
          }
          location /nginx_status {
            # Enable Nginx stats
            stub_status on;
            # Only allow access from localhost
            allow 127.0.0.1;
            # Other request should be denied
            deny all;
            # No need to log this request, its just noise
            access_log on;
          }
        }
        server {
          # Block for API end-points that require a client certificate (Multual Authentication)
          listen 8890 ssl;
          server_name *.gov.bc.ca;
          ssl_password_file certs/passwd.txt;
          ssl_certificate certs/chained.crt;
          ssl_certificate_key certs/private.key;
          server_tokens off;
          ssl_verify_client optional_no_ca;
          ssl_client_certificate certs/plr/trusted-ca-certs.pem;
          root /opt/app-root/src;
          index index.html index.htm;

          # add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
          # add_header X-XSS-Protection "1; mode=block" always;
          # add_header Content-Security-Policy "frame-ancestors 'self'  common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
          add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
          add_header X-Content-Type-Options "nosniff" always;
          # add_header Referrer-Policy "no-referrer-when-downgrade";
          gzip on;
          gzip_min_length 1000;
          gzip_proxied expired no-cache no-store private auth;
          gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;

          location /api/v1/PLRHL7 {
            proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
            proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
          }
        }
      }

#   Frontend Service
- apiVersion: v1
  kind: Service
  metadata:
    name: ${SVC_NAME}-frontend
    namespace: ${OC_LICENSE_PLATE}-${OC_ENV}
  labels:
    app.kubernetes.io/instance: ${OC_ENV}
    app.kubernetes.io/name: frontend
    app.kubernetes.io/version: 0.0.1
  spec:
    ports:
      - name: "http"
        port: 8080
        targetPort: 8080
      - name: "https"
        port: 8443
        targetPort: 8443
      - name: "hpr"
        port: 8888
        targetPort: 8888
      - name: "mutualauth"
        port: 8890
        targetPort: 8890
    selector:
      app.kubernetes.io/instance: ${SVC_NAME}
      app.kubernetes.io/name: frontend
#   Frontend Route (Web)
- kind: Route
  apiVersion: route.openshift.io/v1
  metadata:
    name: ${SVC_NAME}-frontend
    namespace: ${OC_LICENSE_PLATE}-${OC_ENV}
    labels:
      app.kubernetes.io/part-of: ${SVC_NAME}
  spec:
    host: ${SVC_NAME}${URL_STUB}
    to:
      kind: Service
      name: ${SVC_NAME}-frontend
      weight: 100
    port:
      targetPort: http
    tls:
      termination: edge
      insecureEdgeTerminationPolicy: Redirect
    wildcardPolicy: None

#   Frontend Route (Health Practitioner Registration)
- apiVersion: route.openshift.io/v1
  kind: Route
  metadata:
    name: ${SVC_NAME}-frontend-hpr
    namespace: ${OC_LICENSE_PLATE}-${OC_ENV}
    labels:
      app.kubernetes.io/part-of: ${SVC_NAME}
  spec:
    host: ${HPR_URL}
    to:
      kind: Service
      name: ${SVC_NAME}-frontend
      weight: 100
    port:
      targetPort: 8888
    tls:
      termination: edge
      insecureEdgeTerminationPolicy: Allow
    wildcardPolicy: None
#   Frontend Route (Mutual Authentication)
- apiVersion: route.openshift.io/v1
  kind: Route
  metadata:
    name: ${SVC_NAME}-frontend-mutualauth
    namespace: ${OC_LICENSE_PLATE}-${OC_ENV}
    labels:
      app.kubernetes.io/part-of: ${SVC_NAME}
  spec:
    host: ${MAUTH_URL}
    to:
      kind: Service
      name: ${SVC_NAME}-frontend
      weight: 100
    port:
      targetPort: 8890
    tls:
      termination: passthrough
      insecureEdgeTerminationPolicy: Redirect
    wildcardPolicy: None

###########################################
###           Backend Web API           ###
###########################################
#   Backend Web API Deployment
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: ${SVC_NAME}-webapi
    namespace: ${OC_LICENSE_PLATE}-${OC_ENV}
    labels:
      app.openshift.io/runtime: dotnet
      app.kubernetes.io/instance: ${SVC_NAME}
      app.kubernetes.io/name: webapi
      app.kubernetes.io/version: 0.0.1
    annotations:
      image.openshift.io/triggers: |-
        [
          {
            "from": {
              "kind": "ImageStreamTag",
              "namespace": "${OC_LICENSE_PLATE}-tools",
              "name": "prime-webapi-backend:${IMAGE_TAG}"
            },
            "fieldPath": "spec.template.spec.containers[0].image",
            "paused": false
          }
        ]
  spec:
    replicas: ${{BACKEND_REPLICAS}}
    selector:
      matchLabels:
        app.kubernetes.io/instance: ${SVC_NAME}
        app.kubernetes.io/name: webapi
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: ${SVC_NAME}
          app.kubernetes.io/name: webapi
      spec:
        initContainers:
        - name: run-migrations
          image: >-
            image-registry.openshift-image-registry.svc:5000/${OC_LICENSE_PLATE}-tools/prime-webapi-backend:${IMAGE_TAG}
          env:
          - name: PGHOST
            valueFrom:
              configMapKeyRef:
                name: database-cm
                key: database-host
          - name: PGUSER
            valueFrom:
              secretKeyRef:
                name: ${SVC_NAME}-patroni-secret
                key: app-db-username
          - name: PGPASSWORD
            valueFrom:
              secretKeyRef:
                name: ${SVC_NAME}-patroni-secret
                key: app-db-password
          - name: PGDATABASE
            valueFrom:
              secretKeyRef:
                name: ${SVC_NAME}-patroni-secret
                key: app-db-name
          command: ['psql', '-a', '-f', './databaseMigrations.sql']
        containers:
          - name: ${SVC_NAME}-webapi
            image: >-
              image-registry.openshift-image-registry.svc:5000/${OC_LICENSE_PLATE}-tools/prime-webapi-backend:${IMAGE_TAG}
            command:
              - bash
              - '-c'
              - dotnet ./prime.dll -v 2>&1> /dev/stdout
            resources:
              requests:
                cpu: 100m
                memory: 2Gi
            env:
              - name: DOCUMENT_MANAGER_CLIENT_ID
                valueFrom:
                  configMapKeyRef:
                    name: document-manager
                    key: DOCUMENT_MANAGER_CLIENT_ID
              - name: OC_APP
                value: ${OC_APP}
              - name: DOCUMENT_MANAGER_URL
                value: http://${SVC_NAME}-document-manager:6001
              - name: PHARMANET_SSL_CERT_FILENAME
                value: /opt/app-root/etc/certs/pharmanet-api-cert.pfx
              - name: DB_HOST
                valueFrom:
                  configMapKeyRef:
                    name: database-cm
                    key: database-host
              - name: BACKEND_URL
                value: https://${VANITY_URL}/api/v1/
              - name: FRONTEND_URL
                value: https://${VANITY_URL}
              - name: POSTGRESQL_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: ${SVC_NAME}-patroni-secret
                    key: app-db-password
              - name: POSTGRESQL_USER
                valueFrom:
                  secretKeyRef:
                    name: ${SVC_NAME}-patroni-secret
                    key: app-db-username
              - name: POSTGRESQL_DATABASE
                valueFrom:
                  secretKeyRef:
                    name: ${SVC_NAME}-patroni-secret
                    key: app-db-name
              - name: DB_CONNECTION_STRING
                value: "host=$(DB_HOST);port=5432;database=$(POSTGRESQL_DATABASE);username=$(POSTGRESQL_USER);password=$(POSTGRESQL_PASSWORD)"
              - name: SERVER_LOGFILE
                value: /opt/app-root/app/logs/*.log
            ports:
              - containerPort: 1025
                protocol: TCP
              - containerPort: 5001
                protocol: TCP
              - containerPort: 8080
                protocol: TCP
            startupProbe:
              httpGet:
                path: /api/healthcheck/startup
                port: 8080
                scheme: HTTP
              timeoutSeconds: 60
              periodSeconds: 10
              successThreshold: 1
              failureThreshold: 120
            readinessProbe:
              httpGet:
                path: /api/healthcheck/readiness
                port: 8080
                scheme: HTTP
              initialDelaySeconds: 5
              timeoutSeconds: 1
              periodSeconds: 5
              successThreshold: 1
              failureThreshold: 3
            livenessProbe:
              httpGet:
                path: /api/healthcheck/liveness
                port: 8080
                scheme: HTTP
              timeoutSeconds: 1
              periodSeconds: 5
              successThreshold: 1
              failureThreshold: 3
            imagePullPolicy: IfNotPresent
            terminationMessagePolicy: File
            envFrom:
              - configMapRef:
                  name: canada-post-addresscomplete
              - configMapRef:
                  name: ches
              - configMapRef:
                  name: dotnet-webapi-backend
              - configMapRef:
                  name: keycloak
              - configMapRef:
                  name: ldap
              - configMapRef:
                  name: mail-settings
              - configMapRef:
                  name: metabase-embedded
              - configMapRef:
                  name: pharmanet-api
              - configMapRef:
                  name: verifiable-credential
              - configMapRef:
                  name: provider-enrolment-team
              - secretRef:
                  name: canada-post-addresscomplete-secrets
              - secretRef:
                  name: ches-secrets
              - secretRef:
                  name: document-manager-secrets
              - secretRef:
                  name: keycloak-secrets
              - secretRef:
                  name: metabase-embedded-secrets
              - secretRef:
                  name: pharmanet-api-secrets
              - secretRef:
                  name: verifiable-credential-secrets
              - secretRef:
                  name: plr-integration-thumbprint
            volumeMounts:
              - name: cert-volume
                mountPath: /opt/app-root/etc/certs
                readOnly: true
              - name: log-storage
                mountPath: /opt/app-root/app/logs
          - name: fluent-bit
            image: 'docker.io/fluent/fluent-bit:3.0.3'
            resources:
              requests:
                cpu: 10m
                memory: 16Mi
            readinessProbe:
              httpGet:
                path: /
                port: 2020
                scheme: HTTP
              initialDelaySeconds: 10
              timeoutSeconds: 1
              periodSeconds: 60
              successThreshold: 1
              failureThreshold: 3
            livenessProbe:
              httpGet:
                path: /
                port: 2020
                scheme: HTTP
              initialDelaySeconds: 10
              timeoutSeconds: 1
              periodSeconds: 60
              successThreshold: 1
              failureThreshold: 3
            env:
              - name: SERVER_LOGFILE
                value: /opt/app-root/app/logs/*.log
            ports:
              - name: metrics
                containerPort: 2020
                protocol: TCP
              - name: http-plugin
                containerPort: 80
                protocol: TCP
            imagePullPolicy: IfNotPresent
            volumeMounts:
              - name: fluentbit-config
                mountPath: /fluent-bit/etc
              - name: log-storage
                mountPath: /opt/app-root/app/logs
            terminationMessagePolicy: File
        volumes:
          - name: cert-volume
            secret:
              secretName: pharmanet-api-ssl-certs
          - name: log-storage
            emptyDir: {}
          - name: fluentbit-config
            configMap:
              name: webapi-fluentbit-config
        restartPolicy: Always
        terminationGracePeriodSeconds: 30
        dnsPolicy: ClusterFirst
        serviceAccount: default
        schedulerName: default-scheduler
    strategy:
      type: RollingUpdate
      rollingUpdate:
        maxUnavailable: 25%
        maxSurge: 25%
    revisionHistoryLimit: 10
    progressDeadlineSeconds: 600
#   Backend Web API Service
- apiVersion: v1
  kind: Service
  metadata:
    name: ${SVC_NAME}-webapi
    namespace: ${OC_LICENSE_PLATE}-${OC_ENV}
    labels:
      app.kubernetes.io/instance: ${SVC_NAME}
      app.kubernetes.io/name: webapi
      app.kubernetes.io/version: 0.0.1
  spec:
    ports:
      - name: ${SVC_NAME}-webapi
        port: 8080
        targetPort: 8080
    selector:
      app.kubernetes.io/instance: ${SVC_NAME}
      app.kubernetes.io/name: webapi

###########################################
###      Document Manager (backend)     ###
###########################################
#   Document Manager (backend) Deployment
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: ${SVC_NAME}-document-manager
    namespace: ${OC_LICENSE_PLATE}-${OC_ENV}
    labels:
      app.kubernetes.io/instance: ${SVC_NAME}
      app.kubernetes.io/name: document-manager
      app.openshift.io/runtime: python
    annotations:
      image.openshift.io/triggers: |-
        [
          {
            "from": {
              "kind": "ImageStreamTag",
              "namespace": "${OC_LICENSE_PLATE}-tools",
              "name": "prime-document-manager:${IMAGE_TAG}"
            },
            "fieldPath": "spec.template.spec.containers[0].image",
            "paused": false
          }
        ]
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/instance: ${SVC_NAME}
        app.kubernetes.io/name: document-manager
    strategy:
      type: Recreate
      rollingParams:
        updatePeriodSeconds: 1
        intervalSeconds: 1
        timeoutSeconds: 120
        maxSurge: "50%"
        maxUnavailable: 0
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: ${SVC_NAME}
          app.kubernetes.io/name: document-manager
      spec:
        initContainers:
        - name: run-migrations
          image: >-
            image-registry.openshift-image-registry.svc:5000/${OC_LICENSE_PLATE}-tools/prime-document-manager:${IMAGE_TAG}
          command:
            - /opt/app-root/src/app.sh
          args:
            - migrate
          env:
            - name: CACHE_REDIS_HOST
              value: ${SVC_NAME}-redis
            - name: CACHE_REDIS_PASS
              valueFrom:
                secretKeyRef:
                  name: redis
                  key: database-password
            - name: CACHE_REDIS_PORT
              value: "6379"
            - name: PGHOST
              valueFrom:
                  configMapKeyRef:
                    name: database-cm
                    key: database-host
            - name: PGDATABASE
              valueFrom:
                secretKeyRef:
                  name: ${SVC_NAME}-patroni-secret
                  key: app-db-name
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
                  name: ${SVC_NAME}-patroni-secret
                  key: app-db-password
            - name: PGUSER
              valueFrom:
                secretKeyRef:
                  name: ${SVC_NAME}-patroni-secret
                  key: app-db-username
            - name: DOCUMENT_MANAGER_URL
              value: "https://${VANITY_URL}/api/docman/"
            - name: JWT_OIDC_WELL_KNOWN_CONFIG
              valueFrom:
                configMapKeyRef:
                  name: keycloak
                  key: JWT_WELL_KNOWN_CONFIG
            - name: SQLALCHEMY_DATABASE_URI
              value: "postgresql://$(PGUSER):$(PGPASSWORD)@$(PGHOST):5432/$(PGDATABASE)"
          envFrom:
            - configMapRef:
                name: document-manager
        containers:
          - name: ${SVC_NAME}-document-manager
            image: >-
              image-registry.openshift-image-registry.svc:5000/${OC_LICENSE_PLATE}-tools/prime-document-manager:${IMAGE_TAG}
            resources:
              requests:
                cpu: 10m
                memory: 28Mi
            env:
              - name: CACHE_REDIS_HOST
                value: ${SVC_NAME}-redis
              - name: CACHE_REDIS_PASS
                valueFrom:
                  secretKeyRef:
                    name: redis
                    key: database-password
              - name: CACHE_REDIS_PORT
                value: "6379"
              - name: PGHOST
                valueFrom:
                  configMapKeyRef:
                    name: database-cm
                    key: database-host
              - name: PGDATABASE
                valueFrom:
                  secretKeyRef:
                    name: ${SVC_NAME}-patroni-secret
                    key: app-db-name
              - name: PGPASSWORD
                valueFrom:
                  secretKeyRef:
                    name: ${SVC_NAME}-patroni-secret
                    key: app-db-password
              - name: PGUSER
                valueFrom:
                  secretKeyRef:
                    name: ${SVC_NAME}-patroni-secret
                    key: app-db-username
              - name: DOCUMENT_MANAGER_URL
                value: "https://${VANITY_URL}/api/docman/"
              - name: JWT_OIDC_WELL_KNOWN_CONFIG
                valueFrom:
                  configMapKeyRef:
                    name: keycloak
                    key: JWT_WELL_KNOWN_CONFIG
              - name: SQLALCHEMY_DATABASE_URI
                value: "postgresql://$(PGUSER):$(PGPASSWORD)@$(PGHOST):5432/$(PGDATABASE)"
            envFrom:
              - configMapRef:
                  name: document-manager
            volumeMounts:
            # Mount Document Manager to PVC
              - mountPath: /app/
                name: ${SVC_NAME}-document-manager-pvc
            ports:
              - containerPort: 6001
                protocol: TCP
              - containerPort: 9191
                protocol: TCP
            startupProbe:
              httpGet:
                path: /healthcheck
                port: 6001
                scheme: HTTP
              timeoutSeconds: 1
              periodSeconds: 20
              successThreshold: 1
              failureThreshold: 120
            readinessProbe:
              httpGet:
                path: /healthcheck
                port: 6001
                scheme: HTTP
              initialDelaySeconds: 5
              timeoutSeconds: 1
              periodSeconds: 5
              successThreshold: 1
              failureThreshold: 3
        volumes:
          - name: ${SVC_NAME}-document-manager-pvc
            persistentVolumeClaim:
              claimName: '${SVC_NAME}-document-manager-pvc'

#   Document Manager (backend) Service
- apiVersion: v1
  kind: Service
  metadata:
    name: ${SVC_NAME}-document-manager
    namespace: ${OC_LICENSE_PLATE}-${OC_ENV}
    labels:
      app.kubernetes.io/instance: ${SVC_NAME}
      app.kubernetes.io/name: document-manager
  spec:
    ports:
      - name: ${SVC_NAME}-document-manager
        port: 6001
        targetPort: 6001
    selector:
      app.kubernetes.io/instance: ${SVC_NAME}
      app.kubernetes.io/name: document-manager

###########################################
###                Redis                ###
###########################################
#   Redis Deployment
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: ${SVC_NAME}-redis
    namespace: ${OC_LICENSE_PLATE}-${OC_ENV}
    labels:
      app.openshift.io/runtime: redis
      app.kubernetes.io/instance: ${SVC_NAME}
      app.kubernetes.io/name: redis
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/instance: ${SVC_NAME}
        app.kubernetes.io/name: redis
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: ${SVC_NAME}
          app.kubernetes.io/name: redis
      spec:
        volumes:
          - name: ${SVC_NAME}-redis-data
            emptyDir: {}
        containers:
          - name: redis
            image: >-
              image-registry.openshift-image-registry.svc:5000/${OC_LICENSE_PLATE}-tools/redis-6:tini
            resources:
              requests:
                cpu: 5m
                memory: 50Mi
            env:
              - name: REDIS_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: redis
                    key: database-password
              - name: REDIS_PORT
                value: "6379"
            readinessProbe:
              exec:
                command:
                  - /bin/sh
                  - '-i'
                  - '-c'
                  - >-
                    test "$(redis-cli -h 127.0.0.1 -a $REDIS_PASSWORD ping)" ==
                    "PONG"
              initialDelaySeconds: 5
              timeoutSeconds: 1
              periodSeconds: 10
              successThreshold: 1
              failureThreshold: 3
            terminationMessagePath: /dev/termination-log
            livenessProbe:
              tcpSocket:
                port: 6379
              initialDelaySeconds: 30
              timeoutSeconds: 1
              periodSeconds: 10
              successThreshold: 1
              failureThreshold: 3
            securityContext:
              capabilities: {}
              privileged: false
            ports:
              - containerPort: 6379
                protocol: TCP
            imagePullPolicy: IfNotPresent
            volumeMounts:
              - name: ${SVC_NAME}-redis-data
                mountPath: /var/lib/redis/data
            terminationMessagePolicy: File
        restartPolicy: Always
        dnsPolicy: ClusterFirst
        securityContext: {}
        schedulerName: default-scheduler
    strategy:
      type: RollingUpdate
      rollingUpdate:
        maxUnavailable: 25%
        maxSurge: 25%
#   Redis Service
- kind: Service
  apiVersion: v1
  metadata:
    name: ${SVC_NAME}-redis
    namespace: ${OC_LICENSE_PLATE}-${OC_ENV}
    labels:
      app.kubernetes.io/instance: ${SVC_NAME}
      app.kubernetes.io/name: redis
      app.openshift.io/runtime: redis
  spec:
    ports:
      - name: redis
        protocol: TCP
        port: 6379
        targetPort: 6379
    selector:
      app.kubernetes.io/instance: ${SVC_NAME}
      app.kubernetes.io/name: redis