# Source: elasticsearch/templates/statefulset-data.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: elasticsearch-elasticsearch-data
  namespace: openstack
---
# Source: elasticsearch/templates/statefulset-master.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: elasticsearch-master
  namespace: openstack
---
# Source: elasticsearch/templates/statefulset-data.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: elasticsearch-openstack-elasticsearch-elasticsearch-data
  namespace: openstack
rules:
  - apiGroups:
      - ""
      - extensions
      - batch
      - apps
    verbs:
      - get
      - list
    resources:
      - services
      - endpoints
---
# Source: elasticsearch/templates/statefulset-data.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: elasticsearch-elasticsearch-elasticsearch-data
  namespace: openstack
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: elasticsearch-openstack-elasticsearch-elasticsearch-data
subjects:
  - kind: ServiceAccount
    name: elasticsearch-elasticsearch-data
    namespace: openstack
---
# Source: elasticsearch/templates/statefulset-data.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: elasticsearch-data
  annotations:
    "openstackhelm.openstack.org/release_uuid": ""
  labels:
    release_group: elasticsearch
    application: elasticsearch
    component: data
spec:

  serviceName: elasticsearch-data
  podManagementPolicy: "Parallel"
  replicas: 1
  selector:
    matchLabels:
      release_group: elasticsearch
      application: elasticsearch
      component: data
  template:
    metadata:
      labels:
        release_group: elasticsearch
        application: elasticsearch
        component: data
      annotations:

        "openstackhelm.openstack.org/release_uuid": ""
        configmap-bin-hash: "ce4d5a1e377ddb6c8a205e4cf68b49c1b852efb13027939aef9a509cec045d84"
        configmap-etc-hash: "5ec3150daa5f4a814fd6b7bbc86652d67867c66bc35319e2b320d4061e5ba532"
    spec:
      securityContext:
        runAsUser: 0
      serviceAccountName: elasticsearch-elasticsearch-data
      affinity:

        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchExpressions:
                  - key: release_group
                    operator: In
                    values:
                    - elasticsearch
                  - key: application
                    operator: In
                    values:
                    - elasticsearch
                  - key: component
                    operator: In
                    values:
                    - data
              topologyKey: kubernetes.io/hostname
            weight: 10
      nodeSelector:
        openstack-control-plane: "enabled"
      terminationGracePeriodSeconds: 1200
      initContainers:

        - name: init
          image: "quay.io/airshipit/kubernetes-entrypoint:v1.0.0"
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 65534
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: INTERFACE_NAME
              value: eth0
            - name: PATH
              value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/
            - name: DEPENDENCY_SERVICE
              value: "openstack:elasticsearch-logging,openstack:elasticsearch-discovery"
            - name: DEPENDENCY_DAEMONSET
              value: ""
            - name: DEPENDENCY_CONTAINER
              value: ""
            - name: DEPENDENCY_POD_JSON
              value: ""
            - name: DEPENDENCY_CUSTOM_RESOURCE
              value: ""
          command:
            - kubernetes-entrypoint
          volumeMounts:
            []
        - name: memory-map-increase
          image: "docker.io/openstackhelm/heat:newton-ubuntu_xenial"
          imagePullPolicy: IfNotPresent


          securityContext:
            privileged: true
            readOnlyRootFilesystem: true
          command:
            - sysctl
            - -w
            - vm.max_map_count=262144
        - name: elasticsearch-perms
          image: "docker.io/openstackhelm/elasticsearch-s3:7_1_0-20191119"
          imagePullPolicy: IfNotPresent

          securityContext:
            runAsUser: 0
          command:
            - chown
            - -R
            - "elasticsearch:"
            - /data
          volumeMounts:
            - name: storage
              mountPath: /data
      containers:
        - name: elasticsearch-data
          image: "docker.io/openstackhelm/elasticsearch-s3:7_1_0-20191119"
          imagePullPolicy: IfNotPresent


          securityContext:
            capabilities:
              add:
              - IPC_LOCK
              - SYS_RESOURCE
            privileged: true
            readOnlyRootFilesystem: false
          command:
            - /tmp/elasticsearch.sh
            - start_data_node
          ports:
            - name: transport
              containerPort: 9300
          readinessProbe:
            tcpSocket:
              port: 9300
            initialDelaySeconds: 20
            periodSeconds: 10
          env:
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                      fieldPath: metadata.name
            - name: ELASTICSEARCH_USERNAME
              valueFrom:
                secretKeyRef:
                  name: elasticsearch-user-secrets
                  key: ELASTICSEARCH_USERNAME
            - name: ELASTICSEARCH_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: elasticsearch-user-secrets
                  key: ELASTICSEARCH_PASSWORD
            - name: ELASTICSEARCH_ENDPOINT
              value: elasticsearch-logging.openstack.svc.cluster.local:80
            - name: NODE_MASTER
              value: "false"
            - name: NODE_INGEST
              value: "false"
            - name: NODE_DATA
              value: "true"
            - name: HTTP_ENABLE
              value: "false"
            - name: ES_JAVA_OPTS
              value: "-Xms256m -Xmx256m"
            - name: S3_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: elasticsearch-s3-user-creds
                  key: S3_ACCESS_KEY
            - name: S3_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: elasticsearch-s3-user-creds
                  key: S3_SECRET_KEY
            - name: DISCOVERY_SERVICE
              value: elasticsearch-discovery
          volumeMounts:
            - name: pod-tmp
              mountPath: /tmp
            - name: elasticsearch-logs
              mountPath: /logs
            - name: elasticsearch-bin
              mountPath: /tmp/elasticsearch.sh
              subPath: elasticsearch.sh
              readOnly: true
            - name: elasticsearch-etc
              mountPath: /usr/share/elasticsearch/config/elasticsearch.yml
              subPath: elasticsearch.yml
              readOnly: true
            - name: elasticsearch-etc
              mountPath: /usr/share/elasticsearch/config/log4j2.properties
              subPath: log4j2.properties
              readOnly: true
            - name: elasticsearch-etc
              mountPath: /usr/share/elasticsearch/config/jvm.options
              subPath: jvm.options
              readOnly: true
            - name: storage
              mountPath: /data

      volumes:
        - name: pod-tmp
          emptyDir: {}
        - name: elasticsearch-logs
          emptyDir: {}
        - name: elasticsearch-bin
          configMap:
            name: elasticsearch-bin
            defaultMode: 0555
        - name: elasticsearch-etc
          secret:
            secretName: elasticsearch-etc
            defaultMode: 0444

  volumeClaimTemplates:
    - metadata:
        name: storage
      spec:
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 5Gi
        storageClassName: local-storage
---
# Source: elasticsearch/templates/statefulset-master.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: elasticsearch-master
  annotations:
    "openstackhelm.openstack.org/release_uuid": ""
  labels:
    release_group: elasticsearch
    application: elasticsearch
    component: master
spec:
  serviceName: elasticsearch-discovery
  podManagementPolicy: "Parallel"
  replicas: 3
  selector:
    matchLabels:
      release_group: elasticsearch
      application: elasticsearch
      component: master
  revisionHistoryLimit: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 3
  template:
    metadata:
      labels:
        release_group: elasticsearch
        application: elasticsearch
        component: master
      annotations:
        "openstackhelm.openstack.org/release_uuid": ""
        configmap-bin-hash: "ce4d5a1e377ddb6c8a205e4cf68b49c1b852efb13027939aef9a509cec045d84"
        configmap-etc-hash: "4f605a590f99e83a7914414242012b924995caeb3ed56564326dfe733cd828e4"

    spec:
      securityContext:
        runAsUser: 0
      serviceAccountName: elasticsearch-master
      affinity:

        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchExpressions:
                  - key: release_group
                    operator: In
                    values:
                    - elasticsearch
                  - key: application
                    operator: In
                    values:
                    - elasticsearch
                  - key: component
                    operator: In
                    values:
                    - master
              topologyKey: kubernetes.io/hostname
            weight: 10
      terminationGracePeriodSeconds: 600
      nodeSelector:
        openstack-control-plane: "enabled"
      initContainers:

        - name: init
          image: "quay.io/airshipit/kubernetes-entrypoint:v1.0.0"
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 65534
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: INTERFACE_NAME
              value: eth0
            - name: PATH
              value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/
            - name: DEPENDENCY_SERVICE
              value: ""
            - name: DEPENDENCY_DAEMONSET
              value: ""
            - name: DEPENDENCY_CONTAINER
              value: ""
            - name: DEPENDENCY_POD_JSON
              value: ""
            - name: DEPENDENCY_CUSTOM_RESOURCE
              value: ""
          command:
            - kubernetes-entrypoint
          volumeMounts:
            []
        - name: memory-map-increase
          image: "docker.io/openstackhelm/heat:newton-ubuntu_xenial"
          imagePullPolicy: IfNotPresent


          securityContext:
            privileged: true
            readOnlyRootFilesystem: true
          command:
          - sysctl
          - -w
          - vm.max_map_count=262144
        - name: elasticsearch-perms
          image: "docker.io/openstackhelm/elasticsearch-s3:7_1_0-20191119"
          imagePullPolicy: IfNotPresent

          securityContext:
            runAsUser: 0
          command:
            - chown
            - -R
            - "elasticsearch:"
            - /data
          volumeMounts:
            - name: storage
              mountPath: /data
      containers:
        - name: elasticsearch-master

          securityContext:
            capabilities:
              add:
              - IPC_LOCK
              - SYS_RESOURCE
            privileged: true
            readOnlyRootFilesystem: false
          image: "docker.io/openstackhelm/elasticsearch-s3:7_1_0-20191119"
          imagePullPolicy: IfNotPresent

          command:
            - /tmp/elasticsearch.sh
            - start_master_node
          lifecycle:
            preStop:
              exec:
                command:
                  - /tmp/elasticsearch.sh
                  - stop
          ports:
            - name: transport
              containerPort: 9300
          readinessProbe:
            tcpSocket:
              port: 9300
            initialDelaySeconds: 20
            periodSeconds: 10
          env:
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: NODE_MASTER
              value: "true"
            - name: NODE_INGEST
              value: "false"
            - name: NODE_DATA
              value: "false"
            - name: HTTP_ENABLE
              value: "false"
            - name: DISCOVERY_SERVICE
              value: elasticsearch-discovery
            - name: ES_JAVA_OPTS
              value: "-Xms256m -Xmx256m"
            - name: S3_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: elasticsearch-s3-user-creds
                  key: S3_ACCESS_KEY
            - name: S3_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: elasticsearch-s3-user-creds
                  key: S3_SECRET_KEY
          volumeMounts:
            - name: pod-tmp
              mountPath: /tmp
            - name: elasticsearch-logs
              mountPath: /logs
            - name: elasticsearch-bin
              mountPath: /tmp/elasticsearch.sh
              subPath: elasticsearch.sh
              readOnly: true
            - name: elasticsearch-etc
              mountPath: /usr/share/elasticsearch/config/elasticsearch.yml
              subPath: elasticsearch.yml
              readOnly: true
            - name: elasticsearch-etc
              mountPath: /usr/share/elasticsearch/config/log4j2.properties
              subPath: log4j2.properties
              readOnly: true
            - name: elasticsearch-etc
              mountPath: /usr/share/elasticsearch/config/jvm.options
              subPath: jvm.options
              readOnly: true
            - name: storage
              mountPath: /data

      volumes:
        - name: pod-tmp
          emptyDir: {}
        - name: elasticsearch-logs
          emptyDir: {}
        - name: elasticsearch-bin
          configMap:
            name: elasticsearch-bin
            defaultMode: 0555
        - name: elasticsearch-etc
          secret:
            secretName: elasticsearch-etc
            defaultMode: 0444

  volumeClaimTemplates:
    - metadata:
        name: storage
      spec:
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 5Gi
        storageClassName: local-storage
---
