openshift.yml

apiVersion: v1
kind: Template
metadata:
  name: quayio-service-tool
parameters:
- name: QUAY_SERVICE_TOOL_CONFIG_SECRET
  value: "quay-service-tool-config"
  required: true
- name: IMAGE
  value: "quay.io/app-sre/quayio-service-tool"
  required: true
- name: IMAGE_TAG
  value: ""
  required: true
- name: ACTIVE_DEADLINE_SECONDS
  value: "600"
  required: true
- name: CONFIG_MOUNT_PATH
  value: "/config"
  required: true
- name: SYSLOG_IMAGE
  value: ""
  displayName: syslog-cloudwatch-bridge image
  description: syslog-cloudwatch-bridge docker image.
- name: SYSLOG_IMAGE_TAG
  value: ""
  displayName: syslog-cloudwatch-bridge version
  description: syslog-cloudwatch-bridge version
- name: SYSLOG_PORT
  value: "5014"
  displayName: syslog port
- name: TICKER_TIME
  value: "200"
- name: CLOUDWATCH_SECRET
  value: "quay-cloudwatch-iam-user"
  displayName: cloudwatch iam user creds secret
- name: LOG_GROUP_NAME
  value: "quay-service-tool-stage-audit"
- name: QUAY_SYSLOG_CPU_LIMIT
  value: "1"
  displayName: "quay syslog CPU limit"
- name: QUAY_SYSLOG_MEMORY_LIMIT
  value: "2Gi"
  displayName: "quay syslog memory limit"
- name: QUAY_SYSLOG_CPU_REQUEST
  value: "1"
  displayName: "quay syslog CPU request"
- name: QUAY_SYSLOG_MEMORY_REQUEST
  value: "1Gi"
  displayName: "quay syslog memory request"
- name: QUAY_SYSLOG_READINESS_PROBE_INITIAL_DELAY_SECONDS
  value: "15"
  displayName: quay syslog readiness probe initial delay seconds
- name: QUAY_SYSLOG_READINESS_PROBE_PERIOD_SECONDS
  value: "30"
  displayName: quay syslog readiness probe period seconds
- name: QUAY_SYSLOG_READINESS_PROBE_TIMEOUT_SECONDS
  value: "5"
  displayName: quay syslog readiness probe timeout
- name: QUAY_SYSLOG_LIVENESS_PROBE_INITIAL_DELAY_SECONDS
  value: "30"
  displayName: quay syslog liveness probe initial delay seconds
- name: QUAY_SYSLOG_LIVENESS_PROBE_PERIOD_SECONDS
  value: "15"
  displayName: quay syslog liveness probe period seconds
- name: QUAY_SYSLOG_LIVENESS_PROBE_TIMEOUT_SECONDS
  value: "5"
  displayName: quay syslog liveness probe timeout
- name: SYSLOG_SERVER
  value: "localhost"
  displayName: syslog server
- name: SYSLOG_PROTO
  value: "udp"
  displayName: syslog protocol
- name: QUAY_APP_COMPONENT_ANNOTATIONS_KEY
  value: "quay-service-tool-app-deployment"
  displayName: quay service tool app annotation
- name: QUAY_APP_COMPONENT_ANNOTATIONS_VALUE
  value: "update_me_when_secret_changes"
  displayName: quay service tool app annotation value
- name: REPLICAS
  value: "1"
  displayName: replicas for the deployment
  
objects:
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: quayio-service-tool
    labels:
      app: quayio-service-tool
  spec:
    replicas: ${{REPLICAS}}
    selector:
      matchLabels:
        app: quayio-service-tool
    template:
      metadata:
        labels:
          app: quayio-service-tool
        annotations:
          ${{QUAY_APP_COMPONENT_ANNOTATIONS_KEY}}: ${{QUAY_APP_COMPONENT_ANNOTATIONS_VALUE}}
      spec:
        volumes:
        - name: config
          secret:
            secretName: ${{QUAY_SERVICE_TOOL_CONFIG_SECRET}}
        containers:
        - name: syslog-cloudwatch-bridge
          image: ${SYSLOG_IMAGE}:${SYSLOG_IMAGE_TAG}
          ports:
          - containerPort: ${{SYSLOG_PORT}}
            protocol: UDP
            name: syslog-udp-port
          - containerPort: ${{SYSLOG_PORT}}
            protocol: TCP
            name: syslog-tcp-port
          env:
          - name: STREAM_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: TICKER_TIME
            value: ${TICKER_TIME}
          - name: PORT
            value: ${SYSLOG_PORT}
          - name: AWS_REGION
            valueFrom:
              secretKeyRef:
                name: ${{CLOUDWATCH_SECRET}}
                key: AWS_REGION
          - name: AWS_ACCESS_KEY_ID
            valueFrom:
              secretKeyRef:
                name: ${{CLOUDWATCH_SECRET}}
                key: AWS_ACCESS_KEY_ID
          - name: AWS_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: ${{CLOUDWATCH_SECRET}}
                key: AWS_SECRET_ACCESS_KEY
          - name: LOG_GROUP_NAME
            valueFrom:
              secretKeyRef:
                name: ${{CLOUDWATCH_SECRET}}
                key: LOG_GROUP_NAME
          resources:
            limits:
              cpu: ${{QUAY_SYSLOG_CPU_LIMIT}}
              memory: ${{QUAY_SYSLOG_MEMORY_LIMIT}}
            requests:
              cpu: ${{QUAY_SYSLOG_CPU_REQUEST}}
              memory: ${{QUAY_SYSLOG_MEMORY_REQUEST}}
          readinessProbe:
            tcpSocket:
              port: ${{SYSLOG_PORT}}
            initialDelaySeconds: ${{QUAY_SYSLOG_READINESS_PROBE_INITIAL_DELAY_SECONDS}}
            periodSeconds: ${{QUAY_SYSLOG_READINESS_PROBE_PERIOD_SECONDS}}
            timeoutSeconds: ${{QUAY_SYSLOG_READINESS_PROBE_TIMEOUT_SECONDS}}
          livenessProbe:
            tcpSocket:
              port: ${{SYSLOG_PORT}}
            initialDelaySeconds: ${{QUAY_SYSLOG_LIVENESS_PROBE_INITIAL_DELAY_SECONDS}}
            periodSeconds: ${{QUAY_SYSLOG_LIVENESS_PROBE_PERIOD_SECONDS}}
            timeoutSeconds: ${{QUAY_SYSLOG_LIVENESS_PROBE_TIMEOUT_SECONDS}}
        - name: quayio-service-tool
          image: ${IMAGE}:${IMAGE_TAG}
          command:
            - /conf/entrypoint.sh
          volumeMounts:
          - name: config
            mountPath: ${{CONFIG_MOUNT_PATH}}
            readOnly: true
          ports:
          - containerPort: 5000
          resources:
            limits:
              cpu: 100m
              memory: 128Mi
            requests:
              cpu: 100m
              memory: 128Mi
          env:
          - name: CONFIG_PATH
            value: ${{CONFIG_MOUNT_PATH}}
          - name: SYSLOG_SERVER
            value: ${{SYSLOG_SERVER}}
          - name: SYSLOG_PORT
            value: ${SYSLOG_PORT}
          - name: SYSLOG_PROTO
            value: ${{SYSLOG_PROTO}}
          livenessProbe:
            httpGet:
              path: /healthcheck
              port: 5000
            failureThreshold: 3
            initialDelaySeconds: 30
            timeoutSeconds: 30
            periodSeconds: 30
          readinessProbe:
            httpGet:
              path: /healthcheck
              port: 5000
            failureThreshold: 3
            timeoutSeconds: 30
            initialDelaySeconds: 30
            periodSeconds: 30
- apiVersion: v1
  kind: Service
  metadata:
    name: quayio-service-tool
    labels:
      run: quayio-service-tool
  spec:
    ports:
    - name: http
      port: 80
      targetPort: 5000
    selector:
      app: quayio-service-tool
- apiVersion: v1
  kind: Service
  metadata:
    name: quayio-service-tool-load-balancer
    labels:
      run: quayio-service-tool-load-balancer
  spec:
    ports:
    - name: http
      port: 80
      targetPort: 5000
    type: LoadBalancer
    selector:
      app: quayio-service-tool
- apiVersion: v1
  kind: NetworkPolicy
  apiVersion: networking.k8s.io/v1
  metadata:
    name: quayio-service-tool-allow-external
  spec:
    podSelector:
      matchLabels:
        app: quayio-service-tool
    ingress:
      - {}
    policyTypes:
      - Ingress