template.yml

kind: Template
apiVersion: template.openshift.io/v1
parameters:
  - name: APP
    required: true
    value: ely-center-gis
  - name: BRANCH
    required: true
  - name: ACCESS_MODE
    required: true
    value: ReadWriteOnce
  - name: STORAGE_CLASS
    required: true
    value: standard-csi
  - name: DB
    required: true
    value: postgres
  - name: DB_HEALTHCHECK
    required: true
    value: '[
      "sh",
      "-c",
      "PGPASSWORD=$POSTGRES_PASSWORD
        psql -h 0.0.0.0 -U postgres -d postgres -c \"SELECT 1\""
    ]'
  - name: DB_PORT
    required: true
    value: "5432"
  - name: DB_PATH
    required: true
    value: /var/lib/postgresql/data
  - name: DB_DATA
    required: true
    value: /pgdata
  - name: DB_PASSWORD
    required: true
  - name: APP_PORT
    required: true
    value: "8000"
  - name: SMTP_SERVER
    required: true
  - name: SMTP_PORT
    required: true
  - name: ERROR_EMAIL_FROM
    required: true
  - name: ELY_ACCESS_TOKEN
    required: true
  - name: MH_ACCESS_TOKEN
    required: true
  - name: STORAGE
    required: true
  - name: SMALL_STORAGE
    required: true
  - name: HEALTH
    required: true
    value: /healthz
  - name: LIVENESS_PERIOD
    required: true
    value: "30"
  - name: FAILURE_THRESHOLD
    required: true
    value: "10"
  - name: READINESS_PERIOD
    required: true
    value: "5"
  - name: HOST
    required: true
  - name: FINBIF_ACCESS_TOKEN
    required: true
  - name: FINBIF_API_URL
    required: true
  - name: FINBIF_EMAIL
    required: true
  - name: FINBIF_WAREHOUSE
    required: true
  - name: JOB_SECRET
    required: true
  - name: RCLONE_ACCESS_KEY_ID
    required: true
  - name: RCLONE_SECRET_ACCESS_KEY
    required: true
  - name: OBJECT_STORE
    required: true
metadata:
  name: ${APP}
objects:
- kind: PersistentVolumeClaim
  apiVersion: v1
  metadata:
   name: ${DB}-${BRANCH}
  spec:
    storageClassName: ${STORAGE_CLASS}
    accessModes:
    - ${ACCESS_MODE}
    resources:
      requests:
        storage: ${STORAGE}
- kind: PersistentVolumeClaim
  apiVersion: v1
  metadata:
   name: ${APP}-${BRANCH}
  spec:
    storageClassName: ${STORAGE_CLASS}
    accessModes:
    - ${ACCESS_MODE}
    resources:
      requests:
        storage: ${SMALL_STORAGE}
- kind: ConfigMap
  apiVersion: v1
  metadata:
    name: ${APP}-${BRANCH}
  data:
    branch: ${BRANCH}
    db_port: ${DB_PORT}
    app_port: ${APP_PORT}
- kind: Secret
  apiVersion: v1
  metadata:
    name: ${APP}-${BRANCH}
  type: Opaque
  data:
    db_password: ${DB_PASSWORD}
    ely_access_token: ${ELY_ACCESS_TOKEN}
    mh_access_token: ${MH_ACCESS_TOKEN}
    finbif_access_token: ${FINBIF_ACCESS_TOKEN}
    rclone_access_key_id: ${RCLONE_ACCESS_KEY_ID}
    rclone_secret_access_key: ${RCLONE_SECRET_ACCESS_KEY}
    job_secret: ${JOB_SECRET}
- kind: Deployment
  apiVersion: apps/v1
  metadata:
    name: ${DB}-${BRANCH}
    labels:
      app: ${APP}
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: ${APP}
    strategy:
      type: Recreate
    template:
      metadata:
        labels:
          app: ${APP}
          branch: ${BRANCH}
          port: ${DB_PORT}
      spec:
        containers:
        - image: ghcr.io/luomus/postgis-image:main
          imagePullPolicy: Always
          name: ${DB}-${BRANCH}
          volumeMounts:
          - mountPath: ${DB_PATH}
            name: ${DB}-${BRANCH}
          ports:
            - containerPort: ${{DB_PORT}}
          startupProbe:
            exec:
              command: ${{DB_HEALTHCHECK}}
            failureThreshold: ${{FAILURE_THRESHOLD}}
            periodSeconds: ${{LIVENESS_PERIOD}}
          livenessProbe:
            exec:
              command: ${{DB_HEALTHCHECK}}
            failureThreshold: ${{FAILURE_THRESHOLD}}
            periodSeconds: ${{LIVENESS_PERIOD}}
          readinessProbe:
            exec:
              command: ${{DB_HEALTHCHECK}}
            periodSeconds: ${{READINESS_PERIOD}}
          env:
          - name: PGDATA
            value: ${DB_PATH}${DB_DATA}
          - name: POSTGRES_DB
            value: ${DB}
          - name: POSTGRES_PORT
            valueFrom:
              configMapKeyRef:
                name: ${APP}-${BRANCH}
                key: db_port
          - name: POSTGRES_USER
            value: ${DB}
          - name: POSTGRES_PASSWORD
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: db_password
          resources:
            limits:
              cpu: "500m"
              memory: "1Gi"
        volumes:
        - name: ${DB}-${BRANCH}
          persistentVolumeClaim:
            claimName: ${DB}-${BRANCH}
- kind: Deployment
  apiVersion: apps/v1
  metadata:
    name: ${APP}-${BRANCH}
    labels:
      app: ${APP}
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: ${APP}
    strategy:
      type: Recreate
    template:
      metadata:
        labels:
          app: ${APP}
          branch: ${BRANCH}
          port: ${APP_PORT}
      spec:
        containers:
        - image: ghcr.io/luomus/${APP}:${BRANCH}
          imagePullPolicy: Always
          name: ${APP}-${BRANCH}
          volumeMounts:
          - mountPath: /home/user/var
            name: ${APP}-${BRANCH}
          ports:
          - containerPort: ${{APP_PORT}}
          startupProbe:
            httpGet:
              path: ${HEALTH}
              port: ${{APP_PORT}}
            failureThreshold: ${{FAILURE_THRESHOLD}}
            periodSeconds: ${{LIVENESS_PERIOD}}
          livenessProbe:
            httpGet:
              path: ${HEALTH}
              port: ${{APP_PORT}}
            failureThreshold: ${{FAILURE_THRESHOLD}}
            periodSeconds: ${{LIVENESS_PERIOD}}
          readinessProbe:
            httpGet:
              path: ${HEALTH}
              port: ${{APP_PORT}}
            periodSeconds: ${{READINESS_PERIOD}}
          env:
          - name: BRANCH
            valueFrom:
              configMapKeyRef:
                name: ${APP}-${BRANCH}
                key: branch
          - name: OBJECT_STORE
            value: ${OBJECT_STORE}
          - name: RCLONE_CONFIG_DEFAULT_ACCESS_KEY_ID
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: rclone_access_key_id
          - name: RCLONE_CONFIG_DEFAULT_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: rclone_secret_access_key
          - name: APP_PORT
            valueFrom:
              configMapKeyRef:
                name: ${APP}-${BRANCH}
                key: app_port
          - name: ELY_ACCESS_TOKEN
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: ely_access_token
          - name: MH_ACCESS_TOKEN
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: mh_access_token
          - name: PGHOST
            value: ${DB}-${BRANCH}
          - name: PGPORT
            valueFrom:
              configMapKeyRef:
                name: ${APP}-${BRANCH}
                key: db_port
          - name: PGUSER
            value: ${DB}
          - name: PGPASSWORD
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: db_password
          - name: DB_NAME
            value: ${DB}
          - name: FINBIF_ACCESS_TOKEN
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: finbif_access_token
          - name: FINBIF_API_URL
            value: ${FINBIF_API_URL}
          - name: FINBIF_EMAIL
            value: ${FINBIF_EMAIL}
          - name: FINBIF_WAREHOUSE
            value: ${FINBIF_WAREHOUSE}
          - name: FINBIF_USER_AGENT
            value: https://github.com/luomus/${APP}
          - name: STATUS_DIR
            value: var/status
          - name: LOG_DIR
            value: var/logs
          - name: TIMEOUT_IN_HOURS
            value: "8"
          - name: N_SUBSETS
            value: "244"
          - name: JOB_SECRET
            valueFrom:
              secretKeyRef:
                name: ${APP}-${BRANCH}
                key: job_secret
          - name: SMTP_SERVER
            value: ${SMTP_SERVER}
          - name: SMTP_PORT
            value: ${SMTP_PORT}
          - name: ERROR_EMAIL_TO
            value: ${FINBIF_EMAIL}
          - name: ERROR_EMAIL_FROM
            value: ${ERROR_EMAIL_FROM}
        resources:
          limits:
            cpu: "500m"
            memory: "2Gi"
        volumes:
        - name: ${APP}-${BRANCH}
          persistentVolumeClaim:
            claimName: ${APP}-${BRANCH}
- kind: Service
  apiVersion: v1
  metadata:
    name: ${DB}-${BRANCH}
    labels:
      app: ${APP}
  spec:
    ports:
    - name: ${DB_PORT}
      port: ${{DB_PORT}}
      targetPort: ${{DB_PORT}}
    selector:
      app: ${APP}
      branch: ${BRANCH}
      port: ${DB_PORT}
- kind: Service
  apiVersion: v1
  metadata:
    name: ${APP}-${BRANCH}
    labels:
      app: ${APP}
  spec:
    ports:
    - name: ${APP_PORT}
      port: ${{APP_PORT}}
      targetPort: ${{APP_PORT}}
    selector:
      app: ${APP}
      branch: ${BRANCH}
      port: ${APP_PORT}
- kind: Route
  apiVersion: v1
  metadata:
    name: ${APP}-${BRANCH}
    labels:
      app: ${APP}
  spec:
    host: ${HOST}
    port:
      targetPort: ${{APP_PORT}}
    tls:
      insecureEdgeTerminationPolicy: Redirect
    to:
      kind: Service
      name: ${APP}-${BRANCH}
- kind: CronJob
  apiVersion: batch/v1
  metadata:
    name: ${APP}-${BRANCH}
  spec:
    schedule: "0 20 * * *"
    concurrencyPolicy: Forbid
    successfulJobsHistoryLimit: 7
    failedJobsHistoryLimit: 7
    jobTemplate:
      spec:
        template:
          metadata:
            labels:
              app: ${APP}
          spec:
            containers:
            - name: ${APP}-${BRANCH}
              # docker manifest inspect docker.io/redhat/ubi9:9.4 -v | jq '.[0].Descriptor.digest'
              image: docker.io/redhat/ubi9:9.4@sha256:c532187e38fcf6849fae56decd0c58b5ef87b47bfaf24ad9e092cf4c9106f577
              command:
                - 'sh'
                - '-c'
                - >-
                  curl -s -w '%{stderr} Code: %{response_code} URL: %{url_effective}\n'
                  $APP_HOSTNAME:$APP_PORT/job?secret=$JOB_SECRET
              env:
              - name: JOB_SECRET
                valueFrom:
                  secretKeyRef:
                    name: ${APP}-${BRANCH}
                    key: job_secret
              - name: APP_HOSTNAME
                value: ${APP}-${BRANCH}
              - name: APP_PORT
                valueFrom:
                  configMapKeyRef:
                    name: ${APP}-${BRANCH}
                    key: app_port
            restartPolicy: Never