k8s/roles/uyuni/tasks/helm.yml

---
# ConfigMaps
- name: ConfigMap | uyuni-config
  kubernetes.core.k8s:
    api_version: v1
    kind: ConfigMap
    name: uyuni-config
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        labels:
          app.kubernetes.io/part-of: uyuni
        name: uyuni-config
        namespace: '{{ uyuni_namespace }}'
      data:
        fqdn: "{{ uyuni_helm_values['global.fqdn'] }}"
        email: "{{ uyuni_helm_values['server.email'] }}"
        db_host: db
        db_port: '5432'
        db_name: "{{ uyuni_helm_values['db.internal.name'] }}"
        reportdb_host: reportdb
        reportdb_port: '5432'
        reportdb_name: reportdb
      state: present

# PersistentVolumeClaims
- name: PersistentVolumeClaim | ca-certs
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: ca-certs
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: ca-certs
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 10Mi
      state: present

- name: PersistentVolumeClaim | etc-apache2
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: etc-apache2
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: etc-apache2
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Mi
      state: present

- name: PersistentVolumeClaim | etc-cobbler
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: etc-cobbler
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: etc-cobbler
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Mi
      state: present

- name: PersistentVolumeClaim | etc-postfix
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: etc-postfix
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: etc-postfix
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Mi
      state: present

- name: PersistentVolumeClaim | etc-rhn
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: etc-rhn
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: etc-rhn
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Mi
      state: present

- name: PersistentVolumeClaim | etc-salt
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: etc-salt
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: etc-salt
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Mi
      state: present

- name: PersistentVolumeClaim | etc-sssd
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: etc-sssd
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: etc-sssd
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Mi
      state: present

- name: PersistentVolumeClaim | etc-sysconfig
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: etc-sysconfig
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: etc-sysconfig
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 20Mi
      state: present

- name: PersistentVolumeClaim | etc-systemd-multi
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: etc-systemd-multi
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: etc-systemd-multi
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Mi
      state: present

- name: PersistentVolumeClaim | etc-systemd-sockets
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: etc-systemd-sockets
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: etc-systemd-sockets
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Mi
      state: present

- name: PersistentVolumeClaim | etc-tomcat
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: etc-tomcat
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: etc-tomcat
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Mi
      state: present

- name: PersistentVolumeClaim | run-salt-master
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: run-salt-master
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: run-salt-master
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 10Mi
      state: present

- name: PersistentVolumeClaim | srv-formulametadata
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: srv-formulametadata
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: srv-formulametadata
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 10Mi
      state: present

- name: PersistentVolumeClaim | srv-pillar
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: srv-pillar
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: srv-pillar
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 10Mi
      state: present

- name: PersistentVolumeClaim | srv-salt
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: srv-salt
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: srv-salt
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 10Mi
      state: present

- name: PersistentVolumeClaim | srv-spacewalk
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: srv-spacewalk
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: srv-spacewalk
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 10Mi
      state: present

- name: PersistentVolumeClaim | srv-susemanager
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: srv-susemanager
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: srv-susemanager
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Mi
      state: present

- name: PersistentVolumeClaim | srv-tftpboot
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: srv-tftpboot
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: srv-tftpboot
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 300Mi
      state: present

- name: PersistentVolumeClaim | srv-www
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: srv-www
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: srv-www
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 100Gi
      state: present

- name: PersistentVolumeClaim | var-cache
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: var-cache
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: var-cache
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 10Gi
      state: present

- name: PersistentVolumeClaim | var-cobbler
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: var-cobbler
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: var-cobbler
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 10Mi
      state: present

- name: PersistentVolumeClaim | var-log
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: var-log
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: var-log
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 2Gi
      state: present

- name: PersistentVolumeClaim | var-pgsql18
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: var-pgsql18
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: var-pgsql18
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 50Gi
      state: present

- name: PersistentVolumeClaim | var-salt
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: var-salt
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: var-salt
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 10Mi
      state: present

- name: PersistentVolumeClaim | var-search
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: var-search
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: var-search
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 10Gi
      state: present

- name: PersistentVolumeClaim | var-spacewalk
  kubernetes.core.k8s:
    api_version: v1
    kind: PersistentVolumeClaim
    name: var-spacewalk
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        name: var-spacewalk
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 100Gi
      state: present

# Services
- name: Service | cobbler
  kubernetes.core.k8s:
    api_version: v1
    kind: Service
    name: cobbler
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        labels:
          app.kubernetes.io/component: server
          app.kubernetes.io/part-of: uyuni
        name: cobbler
        namespace: '{{ uyuni_namespace }}'
      spec:
        ports:
        - name: cobbler
          port: 25151
        selector:
          app.kubernetes.io/component: server
          app.kubernetes.io/part-of: uyuni
        type: ClusterIP
      state: present

- name: Service | db
  kubernetes.core.k8s:
    api_version: v1
    kind: Service
    name: db
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        labels:
          app.kubernetes.io/component: db
          app.kubernetes.io/part-of: uyuni
        name: db
        namespace: '{{ uyuni_namespace }}'
      spec:
        ports:
        - name: pgsql
          port: 5432
        selector:
          app.kubernetes.io/component: db
          app.kubernetes.io/part-of: uyuni
        type: ClusterIP
      state: present

- name: Service | reportdb
  kubernetes.core.k8s:
    api_version: v1
    kind: Service
    name: reportdb
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        labels:
          app.kubernetes.io/component: db
          app.kubernetes.io/part-of: uyuni
        name: reportdb
        namespace: '{{ uyuni_namespace }}'
      spec:
        ports:
        - name: pgsql
          port: 5432
        selector:
          app.kubernetes.io/component: db
          app.kubernetes.io/part-of: uyuni
        type: ClusterIP
      state: present

- name: Service | salt
  kubernetes.core.k8s:
    api_version: v1
    kind: Service
    name: salt
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        labels:
          app.kubernetes.io/component: server
          app.kubernetes.io/part-of: uyuni
        name: salt
        namespace: '{{ uyuni_namespace }}'
      spec:
        ports:
        - name: publish
          port: 4505
        - name: request
          port: 4506
        selector:
          app.kubernetes.io/component: server
          app.kubernetes.io/part-of: uyuni
        type: ClusterIP
      state: present

- name: Service | taskomatic-internal
  kubernetes.core.k8s:
    api_version: v1
    kind: Service
    name: taskomatic-internal
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        labels:
          app.kubernetes.io/component: server
          app.kubernetes.io/part-of: uyuni
        name: taskomatic-internal
        namespace: '{{ uyuni_namespace }}'
      spec:
        ports:
        - name: jmx
          port: 5557
        - name: mtrx
          port: 9800
        selector:
          app.kubernetes.io/component: server
          app.kubernetes.io/part-of: uyuni
        type: ClusterIP
      state: present

- name: Service | tomcat-internal
  kubernetes.core.k8s:
    api_version: v1
    kind: Service
    name: tomcat-internal
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        labels:
          app.kubernetes.io/component: server
          app.kubernetes.io/part-of: uyuni
        name: tomcat-internal
        namespace: '{{ uyuni_namespace }}'
      spec:
        ports:
        - name: node-exporter
          port: 9100
        - name: jmx
          port: 5556
        - name: pgsql-exporter
          port: 9187
        selector:
          app.kubernetes.io/component: server
          app.kubernetes.io/part-of: uyuni
        type: ClusterIP
      state: present

- name: Service | web
  kubernetes.core.k8s:
    api_version: v1
    kind: Service
    name: web
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: v1
      metadata:
        labels:
          app.kubernetes.io/component: server
          app.kubernetes.io/part-of: uyuni
        name: web
        namespace: '{{ uyuni_namespace }}'
      spec:
        ports:
        - name: http
          port: 80
          protocol: TCP
          targetPort: 80
        selector:
          app.kubernetes.io/component: server
          app.kubernetes.io/part-of: uyuni
        type: ClusterIP
      state: present

# Deployments
- name: Deployment | db
  kubernetes.core.k8s:
    api_version: apps/v1
    kind: Deployment
    name: db
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: apps/v1
      metadata:
        creationTimestamp: null
        labels:
          app.kubernetes.io/component: db
          app.kubernetes.io/part-of: uyuni
        name: db
        namespace: '{{ uyuni_namespace }}'
      spec:
        replicas: 1
        selector:
          matchLabels:
            app.kubernetes.io/component: db
            app.kubernetes.io/part-of: uyuni
        strategy:
          type: Recreate
        template:
          metadata:
            labels:
              app.kubernetes.io/component: db
              app.kubernetes.io/part-of: uyuni
          spec:
            containers:
            - env:
              - name: TZ
                value: Europe/Moscow
              - name: POSTGRES_USER
                valueFrom:
                  secretKeyRef:
                    key: username
                    name: db-admin-credentials
              - name: POSTGRES_PASSWORD
                valueFrom:
                  secretKeyRef:
                    key: password
                    name: db-admin-credentials
              - name: MANAGER_USER
                valueFrom:
                  secretKeyRef:
                    key: username
                    name: db-credentials
              - name: MANAGER_PASS
                valueFrom:
                  secretKeyRef:
                    key: password
                    name: db-credentials
              - name: REPORT_DB_USER
                valueFrom:
                  secretKeyRef:
                    key: username
                    name: reportdb-credentials
              - name: REPORT_DB_PASS
                valueFrom:
                  secretKeyRef:
                    key: password
                    name: reportdb-credentials
              image: registry.opensuse.org/uyuni/server-postgresql:latest
              imagePullPolicy: IfNotPresent
              name: db
              volumeMounts:
              - mountPath: /var/lib/pgsql
                name: var-pgsql
              - mountPath: /etc/pki
                name: tls-secret
            securityContext:
              fsGroup: 999
            volumes:
            - name: var-pgsql
              persistentVolumeClaim:
                claimName: var-pgsql18
            - name: tls-secret
              secret:
                items:
                - key: tls.crt
                  path: tls/certs/spacewalk.crt
                - key: tls.key
                  mode: 0640
                  path: tls/private/pg-spacewalk.key
                - key: ca.crt
                  path: trust/anchors/LOCAL-RHN-ORG-TRUSTED-SSL-CERT
                secretName: db-cert
      state: present

- name: Deployment | uyuni
  kubernetes.core.k8s:
    api_version: apps/v1
    kind: Deployment
    name: uyuni
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: apps/v1
      metadata:
        labels:
          app.kubernetes.io/component: server
          app.kubernetes.io/part-of: uyuni
        name: uyuni
        namespace: '{{ uyuni_namespace }}'
      spec:
        replicas: 1
        selector:
          matchLabels:
            app.kubernetes.io/component: server
            app.kubernetes.io/part-of: uyuni
        strategy:
          type: Recreate
        template:
          metadata:
            labels:
              app.kubernetes.io/component: server
              app.kubernetes.io/part-of: uyuni
          spec:
            containers:
            - env:
              - name: container
                value: oci
              - name: TZ
                value: Europe/Moscow
              - name: ADMIN_USER
                valueFrom:
                  secretKeyRef:
                    key: username
                    name: admin-credentials
                    optional: false
              - name: ADMIN_PASS
                valueFrom:
                  secretKeyRef:
                    key: password
                    name: admin-credentials
                    optional: false
              - name: MANAGER_USER
                valueFrom:
                  secretKeyRef:
                    key: username
                    name: db-credentials
                    optional: false
              - name: MANAGER_PASS
                valueFrom:
                  secretKeyRef:
                    key: password
                    name: db-credentials
                    optional: false
              - name: REPORT_DB_USER
                valueFrom:
                  secretKeyRef:
                    key: username
                    name: reportdb-credentials
                    optional: false
              - name: REPORT_DB_PASS
                valueFrom:
                  secretKeyRef:
                    key: password
                    name: reportdb-credentials
                    optional: false
              - name: MANAGER_DB_NAME
                value: "{{ uyuni_helm_values['db.internal.name'] }}"
              - name: MANAGER_DB_HOST
                value: db
              - name: MANAGER_DB_CA_CERT
                value: /etc/pki/trust/anchors/DB-RHN-ORG-TRUSTED-SSL-CERT
              - name: MANAGER_DB_PORT
                value: '5432'
              - name: EXTERNALDB_PROVIDER
              - name: ISS_PARENT
              - name: REPORT_DB_NAME
                value: reportdb
              - name: REPORT_DB_HOST
                value: reportdb
              - name: REPORT_DB_CA_CERT
                value: /etc/pki/trust/anchors/DB-RHN-ORG-TRUSTED-SSL-CERT
              - name: REPORT_DB_PORT
                value: '5432'
              - name: MANAGER_ADMIN_EMAIL
                valueFrom:
                  configMapKeyRef:
                    key: email
                    name: uyuni-config
                    optional: false
              - name: MANAGER_MAIL_FROM
                valueFrom:
                  configMapKeyRef:
                    key: email
                    name: uyuni-config
                    optional: false
              - name: UYUNI_HOSTNAME
                valueFrom:
                  configMapKeyRef:
                    key: fqdn
                    name: uyuni-config
                    optional: false
              image: registry.opensuse.org/uyuni/server:latest
              imagePullPolicy: IfNotPresent
              lifecycle:
                preStop:
                  exec:
                    command:
                    - /bin/sh
                    - -c
                    - spacewalk-service stop
              name: uyuni
              securityContext:
                capabilities:
                  add:
                  - SYS_ADMIN
                seLinuxOptions:
                  level: s0
              ports:
              - containerPort: 80
              - containerPort: 4505
              - containerPort: 4506
              - containerPort: 25151
              - containerPort: 9100
              - containerPort: 5556
              - containerPort: 5557
              - containerPort: 9187
              - containerPort: 9800
              startupProbe:
                exec:
                  command:
                  - /usr/bin/startup-check.sh
                periodSeconds: 10
                timeoutSeconds: 600
                initialDelaySeconds: 360
                failureThreshold: 3600
              livenessProbe:
                exec:
                  command:
                  - /usr/bin/liveness-check.sh
                timeoutSeconds: 60
                failureThreshold: 5
                periodSeconds: 60
              readinessProbe:
                httpGet:
                  path: /rhn/manager/api/api/getVersion
                  port: 80
                  scheme: HTTP
                periodSeconds: 10
                successThreshold: 1
                initialDelaySeconds: 120
              volumeMounts:
              - mountPath: /var/lib/cobbler
                name: var-cobbler
              - mountPath: /var/lib/rhn/search
                name: var-search
              - mountPath: /var/lib/salt
                name: var-salt
              - mountPath: /var/cache
                name: var-cache
              - mountPath: /var/spacewalk
                name: var-spacewalk
              - mountPath: /var/log
                name: var-log
              - mountPath: /srv/salt
                name: srv-salt
              - mountPath: /srv/www/
                name: srv-www
              - mountPath: /srv/tftpboot
                name: srv-tftpboot
              - mountPath: /srv/formula_metadata
                name: srv-formulametadata
              - mountPath: /srv/pillar
                name: srv-pillar
              - mountPath: /srv/susemanager
                name: srv-susemanager
              - mountPath: /srv/spacewalk
                name: srv-spacewalk
              - mountPath: /etc/pki/trust/anchors/
                name: ca-certs
              - mountPath: /run/salt/master
                name: run-salt-master
              - mountPath: /etc/apache2
                name: etc-apache2
              - mountPath: /etc/systemd/system/multi-user.target.wants
                name: etc-systemd-multi
              - mountPath: /etc/systemd/system/sockets.target.wants
                name: etc-systemd-sockets
              - mountPath: /etc/salt
                name: etc-salt
              - mountPath: /etc/tomcat
                name: etc-tomcat
              - mountPath: /etc/cobbler
                name: etc-cobbler
              - mountPath: /etc/sysconfig
                name: etc-sysconfig
              - mountPath: /etc/postfix
                name: etc-postfix
              - mountPath: /etc/sssd
                name: etc-sssd
              - mountPath: /etc/rhn
                name: etc-rhn
              - mountPath: /etc/pki/trust/anchors/LOCAL-RHN-ORG-TRUSTED-SSL-CERT
                name: ca-cert
                readOnly: true
                subPath: ca.crt
              - mountPath: /usr/share/susemanager/salt/certs/RHN-ORG-TRUSTED-SSL-CERT
                name: ca-cert
                readOnly: true
                subPath: ca.crt
              - mountPath: /srv/www/htdocs/pub/RHN-ORG-TRUSTED-SSL-CERT
                name: ca-cert
                readOnly: true
                subPath: ca.crt
              - mountPath: /etc/pki/trust/anchors/DB-RHN-ORG-TRUSTED-SSL-CERT
                name: db-ca-cert
                readOnly: true
                subPath: ca.crt
              - mountPath: /etc/pki/
                name: tls
              - mountPath: /run
                name: run
              - mountPath: /sys/fs/cgroup
                name: sys-fs-cgroup
            initContainers:
            - command:
              - sh
              - -x
              - -c
              - "# Fill the empty volumes\nfor vol in /var/lib/cobbler \\\n       /var/lib/rhn/search \\\n       /var/lib/salt \\\n       /var/cache \\\n       /var/log \\\n       /srv/salt \\\n       /srv/www\
                \ \\\n       /srv/tftpboot \\\n       /srv/formula_metadata \\\n       /srv/pillar \\\n       /srv/susemanager \\\n       /srv/spacewalk \\\n       /etc/apache2 \\\n       /etc/rhn \\\n      \
                \ /etc/systemd/system/multi-user.target.wants \\\n       /etc/systemd/system/sockets.target.wants \\\n       /etc/salt \\\n       /etc/tomcat \\\n       /etc/cobbler \\\n       /etc/sysconfig\
                \ \\\n       /etc/postfix \\\n       /etc/sssd\ndo\n  chown --reference=$vol /mnt$vol;\n  chmod --reference=$vol /mnt$vol;\n  if [ -z \"$(ls -A /mnt$vol)\" ]; then\n      cp -a $vol/. /mnt$vol;\n\
                \  fi\ndone\n"
              image: registry.opensuse.org/uyuni/server:latest
              imagePullPolicy: IfNotPresent
              name: init-volumes
              securityContext:
                seLinuxOptions:
                  level: s0
              volumeMounts:
              - mountPath: /mnt/var/lib/cobbler
                name: var-cobbler
              - mountPath: /mnt/var/lib/rhn/search
                name: var-search
              - mountPath: /mnt/var/lib/salt
                name: var-salt
              - mountPath: /mnt/var/cache
                name: var-cache
              - mountPath: /mnt/var/spacewalk
                name: var-spacewalk
              - mountPath: /mnt/var/log
                name: var-log
              - mountPath: /mnt/srv/salt
                name: srv-salt
              - mountPath: /mnt/srv/www/
                name: srv-www
              - mountPath: /mnt/srv/tftpboot
                name: srv-tftpboot
              - mountPath: /mnt/srv/formula_metadata
                name: srv-formulametadata
              - mountPath: /mnt/srv/pillar
                name: srv-pillar
              - mountPath: /mnt/srv/susemanager
                name: srv-susemanager
              - mountPath: /mnt/srv/spacewalk
                name: srv-spacewalk
              - mountPath: /mnt/etc/pki/trust/anchors/
                name: ca-certs
              - mountPath: /mnt/run/salt/master
                name: run-salt-master
              - mountPath: /mnt/etc/apache2
                name: etc-apache2
              - mountPath: /mnt/etc/systemd/system/multi-user.target.wants
                name: etc-systemd-multi
              - mountPath: /mnt/etc/systemd/system/sockets.target.wants
                name: etc-systemd-sockets
              - mountPath: /mnt/etc/salt
                name: etc-salt
              - mountPath: /mnt/etc/tomcat
                name: etc-tomcat
              - mountPath: /mnt/etc/cobbler
                name: etc-cobbler
              - mountPath: /mnt/etc/sysconfig
                name: etc-sysconfig
              - mountPath: /mnt/etc/postfix
                name: etc-postfix
              - mountPath: /mnt/etc/sssd
                name: etc-sssd
              - mountPath: /mnt/etc/rhn
                name: etc-rhn
            - command:
              - sh
              - -c
              - "until pg_isready -U $MANAGER_USER -h $MANAGER_DB_HOST -p $MANAGER_DB_PORT -d $MANAGER_DB_NAME; do\n  sleep 60\ndone\n\nuntil pg_isready -U $REPORT_DB_USER -h $REPORT_DB_HOST -p $REPORT_DB_PORT\
                \ -d $REPORT_DB_NAME; do\n  sleep 60\ndone\n"
              env:
              - name: MANAGER_DB_HOST
                valueFrom:
                  configMapKeyRef:
                    key: db_host
                    name: uyuni-config
                    optional: false
              - name: MANAGER_DB_PORT
                valueFrom:
                  configMapKeyRef:
                    key: db_port
                    name: uyuni-config
                    optional: false
              - name: MANAGER_DB_NAME
                valueFrom:
                  configMapKeyRef:
                    key: db_name
                    name: uyuni-config
                    optional: false
              - name: MANAGER_USER
                valueFrom:
                  secretKeyRef:
                    key: username
                    name: db-credentials
                    optional: false
              - name: REPORT_DB_HOST
                valueFrom:
                  configMapKeyRef:
                    key: reportdb_host
                    name: uyuni-config
                    optional: false
              - name: REPORT_DB_PORT
                valueFrom:
                  configMapKeyRef:
                    key: reportdb_port
                    name: uyuni-config
                    optional: false
              - name: REPORT_DB_NAME
                valueFrom:
                  configMapKeyRef:
                    key: reportdb_name
                    name: uyuni-config
                    optional: false
              - name: REPORT_DB_USER
                valueFrom:
                  secretKeyRef:
                    key: username
                    name: reportdb-credentials
                    optional: false
              image: registry.opensuse.org/uyuni/server:latest
              imagePullPolicy: IfNotPresent
              name: db-waiter
            volumes:
            - name: var-cobbler
              persistentVolumeClaim:
                claimName: var-cobbler
            - name: var-search
              persistentVolumeClaim:
                claimName: var-search
            - name: var-salt
              persistentVolumeClaim:
                claimName: var-salt
            - name: var-cache
              persistentVolumeClaim:
                claimName: var-cache
            - name: var-spacewalk
              persistentVolumeClaim:
                claimName: var-spacewalk
            - name: var-log
              persistentVolumeClaim:
                claimName: var-log
            - name: srv-salt
              persistentVolumeClaim:
                claimName: srv-salt
            - name: srv-www
              persistentVolumeClaim:
                claimName: srv-www
            - name: srv-tftpboot
              persistentVolumeClaim:
                claimName: srv-tftpboot
            - name: srv-formulametadata
              persistentVolumeClaim:
                claimName: srv-formulametadata
            - name: srv-pillar
              persistentVolumeClaim:
                claimName: srv-pillar
            - name: srv-susemanager
              persistentVolumeClaim:
                claimName: srv-susemanager
            - name: srv-spacewalk
              persistentVolumeClaim:
                claimName: srv-spacewalk
            - name: ca-certs
              persistentVolumeClaim:
                claimName: ca-certs
            - name: run-salt-master
              persistentVolumeClaim:
                claimName: run-salt-master
            - name: etc-apache2
              persistentVolumeClaim:
                claimName: etc-apache2
            - name: etc-systemd-multi
              persistentVolumeClaim:
                claimName: etc-systemd-multi
            - name: etc-systemd-sockets
              persistentVolumeClaim:
                claimName: etc-systemd-sockets
            - name: etc-salt
              persistentVolumeClaim:
                claimName: etc-salt
            - name: etc-tomcat
              persistentVolumeClaim:
                claimName: etc-tomcat
            - name: etc-cobbler
              persistentVolumeClaim:
                claimName: etc-cobbler
            - name: etc-sysconfig
              persistentVolumeClaim:
                claimName: etc-sysconfig
            - name: etc-postfix
              persistentVolumeClaim:
                claimName: etc-postfix
            - name: etc-sssd
              persistentVolumeClaim:
                claimName: etc-sssd
            - name: etc-rhn
              persistentVolumeClaim:
                claimName: etc-rhn
            - configMap:
                defaultMode: 420
                name: uyuni-ca
              name: ca-cert
            - configMap:
                defaultMode: 420
                name: db-ca
              name: db-ca-cert
            - name: tls
              secret:
                defaultMode: 420
                items:
                - key: tls.crt
                  path: tls/certs/spacewalk.crt
                - key: tls.key
                  mode: 256
                  path: tls/private/spacewalk.key
                secretName: uyuni-cert
            - emptyDir:
                medium: Memory
                sizeLimit: 256Mi
              name: run
            - name: sys-fs-cgroup
              emptyDir: null
      state: present

# Ingresses
- name: Ingress | uyuni-ingress-ssl
  kubernetes.core.k8s:
    api_version: networking.k8s.io/v1
    kind: Ingress
    name: uyuni-ingress-ssl
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: networking.k8s.io/v1
      metadata:
        creationTimestamp: null
        name: uyuni-ingress-ssl
        namespace: '{{ uyuni_namespace }}'
        annotations:
          traefik.ingress.kubernetes.io/router.tls: 'true'
          traefik.ingress.kubernetes.io/router.tls.domains.n.main: "{{ uyuni_helm_values['global.fqdn'] }}"
          traefik.ingress.kubernetes.io/router.entrypoints: websecure
          traefik.ingress.kubernetes.io/router.priority: '100'
          traefik.ingress.kubernetes.io/router.middlewares: uyuni-server-uyuni-strip-prefixes@kubernetescrd
        labels:
          app.kubernetes.io/part-of: uyuni
          app.kubernetes.io/component: server
      spec:
        ingressClassName: traefik
        tls:
        - hosts:
          - "{{ uyuni_helm_values['global.fqdn'] }}"
          secretName: uyuni-cert
        rules:
        - host: "{{ uyuni_helm_values['global.fqdn'] }}"
          http:
            paths:
            - path: /postgresql-exporter
              backend:
                service:
                  name: tomcat-internal
                  port:
                    number: 9187
              pathType: Prefix
            - path: /node-exporter
              backend:
                service:
                  name: tomcat-internal
                  port:
                    number: 9100
              pathType: Prefix
            - path: /tasko-exporter
              backend:
                service:
                  name: taskomatic-internal
                  port:
                    number: 9800
              pathType: Prefix
            - path: /tasko-jmx
              backend:
                service:
                  name: taskomatic-internal
                  port:
                    number: 5557
              pathType: Prefix
            - path: /tomcat-jmx
              backend:
                service:
                  name: tomcat-internal
                  port:
                    number: 5556
              pathType: Prefix
      state: present

- name: Ingress | uyuni-ingress-ssl-redirect
  kubernetes.core.k8s:
    api_version: networking.k8s.io/v1
    kind: Ingress
    name: uyuni-ingress-ssl-redirect
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: networking.k8s.io/v1
      metadata:
        creationTimestamp: null
        name: uyuni-ingress-ssl-redirect
        namespace: '{{ uyuni_namespace }}'
        annotations:
          traefik.ingress.kubernetes.io/router.middlewares: uyuni-server-uyuni-https-redirect@kubernetescrd
          traefik.ingress.kubernetes.io/router.entrypoints: web
          traefik.ingress.kubernetes.io/router.priority: '1'
        labels:
          app.kubernetes.io/part-of: uyuni
          app.kubernetes.io/component: server
      spec:
        ingressClassName: traefik
        rules:
        - host: "{{ uyuni_helm_values['global.fqdn'] }}"
          http:
            paths:
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /
              pathType: Prefix
      state: present

- name: Ingress | uyuni-ingress-nossl
  kubernetes.core.k8s:
    api_version: networking.k8s.io/v1
    kind: Ingress
    name: uyuni-ingress-nossl
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: networking.k8s.io/v1
      metadata:
        creationTimestamp: null
        name: uyuni-ingress-nossl
        namespace: '{{ uyuni_namespace }}'
        annotations:
          traefik.ingress.kubernetes.io/router.tls: 'false'
          traefik.ingress.kubernetes.io/router.entrypoints: web
          traefik.ingress.kubernetes.io/router.priority: '100'
          traefik.ingress.kubernetes.io/router.middlewares: uyuni-server-uyuni-strip-prefixes@kubernetescrd
        labels:
          app.kubernetes.io/part-of: uyuni
          app.kubernetes.io/component: server
      spec:
        ingressClassName: traefik
        rules:
        - host: "{{ uyuni_helm_values['global.fqdn'] }}"
          http:
            paths:
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /pub
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /rhn/kickstart/DownloadFile
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /rhn/common/DownloadFile
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /rhn/rpc/api
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /rpc/api
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /rhn/errors
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /rhn/ty/TinyUrl
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /rhn/websocket
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /rhn/metrics
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /cobbler_api
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /cblr
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /httpboot
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /images
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /cobbler
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /os-images
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /tftp
              pathType: Prefix
            - backend:
                service:
                  name: web
                  port:
                    number: 80
              path: /docs
              pathType: Prefix
            - path: /postgresql-exporter
              backend:
                service:
                  name: tomcat-internal
                  port:
                    number: 9187
              pathType: Prefix
            - path: /node-exporter
              backend:
                service:
                  name: tomcat-internal
                  port:
                    number: 9100
              pathType: Prefix
            - path: /tasko-exporter
              backend:
                service:
                  name: taskomatic-internal
                  port:
                    number: 9800
              pathType: Prefix
            - path: /tasko-jmx
              backend:
                service:
                  name: taskomatic-internal
                  port:
                    number: 5557
              pathType: Prefix
            - path: /tomcat-jmx
              backend:
                service:
                  name: tomcat-internal
                  port:
                    number: 5556
              pathType: Prefix
      state: present

# Traefik IngressRouteTCP
- name: IngressRouteTCP | reportdb-pgsql-route
  kubernetes.core.k8s:
    api_version: traefik.io/v1alpha1
    kind: IngressRouteTCP
    name: reportdb-pgsql-route
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: traefik.io/v1alpha1
      metadata:
        name: reportdb-pgsql-route
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
        annotations:
          kubernetes.io/ingress.class: traefik
      spec:
        entryPoints:
        - reportdb-pgsql
        routes:
        - match: HostSNI(`*`)
          services:
          - name: reportdb
            port: 5432
      state: present

- name: IngressRouteTCP | salt-publish-route
  kubernetes.core.k8s:
    api_version: traefik.io/v1alpha1
    kind: IngressRouteTCP
    name: salt-publish-route
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: traefik.io/v1alpha1
      metadata:
        name: salt-publish-route
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
        annotations:
          kubernetes.io/ingress.class: traefik
      spec:
        entryPoints:
        - salt-publish
        routes:
        - match: HostSNI(`*`)
          services:
          - name: salt
            port: 4505
      state: present

- name: IngressRouteTCP | salt-request-route
  kubernetes.core.k8s:
    api_version: traefik.io/v1alpha1
    kind: IngressRouteTCP
    name: salt-request-route
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: traefik.io/v1alpha1
      metadata:
        name: salt-request-route
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
        annotations:
          kubernetes.io/ingress.class: traefik
      spec:
        entryPoints:
        - salt-request
        routes:
        - match: HostSNI(`*`)
          services:
          - name: salt
            port: 4506
      state: present

# Traefik Middleware
- name: Middleware | uyuni-https-redirect
  kubernetes.core.k8s:
    api_version: traefik.io/v1alpha1
    kind: Middleware
    name: uyuni-https-redirect
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: traefik.io/v1alpha1
      metadata:
        name: uyuni-https-redirect
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        redirectScheme:
          scheme: https
          permanent: true
      state: present

- name: Middleware | uyuni-strip-prefixes
  kubernetes.core.k8s:
    api_version: traefik.io/v1alpha1
    kind: Middleware
    name: uyuni-strip-prefixes
    namespace: "{{ uyuni_namespace }}"
    kubeconfig: "{{ uyuni_kubeconfig }}"
    definition:
      apiVersion: traefik.io/v1alpha1
      metadata:
        name: uyuni-strip-prefixes
        namespace: '{{ uyuni_namespace }}'
        labels:
          app.kubernetes.io/part-of: uyuni
      spec:
        stripPrefix:
          prefixes:
          - /postgresql-exporter
          - /node-exporter
          - /tasko-exporter
          - /tasko-jmx
          - /tomcat-jmx
          - /saline
      state: present