# Fixtures for the patchmon install-test: throwaway postgres + redis, a dex
# OIDC provider, the secrets the 1Password operator would otherwise
# materialize (release name: ci), a pre-bound world-writable hostPath PV for
# the assets volume (the non-root backend writes agent assets at boot;
# hostPath does not support fsGroup), and a Service alias "backend": the
# frontend image's nginx template resolves an upstream host literally named
# "backend" at startup (found during the probes verification of PR #21).
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ci-static
provisioner: kubernetes.io/no-provisioner
---
apiVersion: batch/v1
kind: Job
metadata:
  name: node-setup
spec:
  backoffLimit: 2
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: setup
          image: public.ecr.aws/docker/library/busybox:1.36
          command:
            - sh
            - -c
            - >
              mkdir -p /pv/patchmon/patchmon-assets /pv/patchmon/patchmon-agents &&
              chmod -R 0777 /pv/patchmon
          volumeMounts:
            - name: pv
              mountPath: /pv
      volumes:
        - name: pv
          hostPath:
            path: /var/lib/ci-pv
            type: DirectoryOrCreate
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: ci-patchmon-data
spec:
  capacity:
    storage: 10Gi
  accessModes:
    # The assets PVC is shared by backend and frontend as ReadWriteMany.
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: ci-static
  claimRef:
    namespace: default
    name: ci-patchmon-pvc
  hostPath:
    path: /var/lib/ci-pv/patchmon
    type: DirectoryOrCreate
---
apiVersion: v1
kind: Service
metadata:
  name: backend
spec:
  selector:
    app: ci-patchmon-backend
  ports:
    - name: http
      port: 80
      targetPort: 3001
    - name: direct
      port: 3001
      targetPort: 3001
---
apiVersion: v1
kind: Secret
metadata:
  name: ci-patchmon-postgres-secret
stringData:
  database-url: postgresql://ci:ci@postgres:5432/patchmon
---
apiVersion: v1
kind: Secret
metadata:
  name: ci-patchmon-redis-secret
stringData:
  host: redis
  port: "6379"
  username: default
  password: cipass
  db: "0"
---
apiVersion: v1
kind: Secret
metadata:
  name: ci-patchmon-patchmon-secret
stringData:
  jwt-secret: patchmon-ci-jwt-secret-0123456789abcdef0123456789abcdef
  encryption-key: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
  session-secret: patchmon-ci-session-secret-0123456789abcdef0123456789abcdef
---
apiVersion: v1
kind: Secret
metadata:
  name: ci-patchmon-oidc-secret
stringData:
  issuer-url: http://dex.default.svc.cluster.local:5556/dex
  client-id: ci-client
  client-secret: ci-client-secret
  redirect-uri: https://patchmon.ci.local/auth/callback
  requested-scopes: openid profile email
  button-text: CI SSO
  user-group-name: users
  admin-group-name: admins
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
  labels:
    app: postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: public.ecr.aws/docker/library/postgres:16-alpine
          env:
            - name: POSTGRES_USER
              value: ci
            - name: POSTGRES_PASSWORD
              value: ci
            - name: POSTGRES_DB
              value: patchmon
          ports:
            - containerPort: 5432
          readinessProbe:
            exec:
              command: ["pg_isready", "-U", "ci"]
            periodSeconds: 5
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
      volumes:
        - name: data
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: postgres
spec:
  selector:
    app: postgres
  ports:
    - port: 5432
      targetPort: 5432
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis
  labels:
    app: redis
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
    spec:
      containers:
        - name: redis
          image: public.ecr.aws/docker/library/redis:7-alpine
          args: ["redis-server", "--requirepass", "cipass"]
          ports:
            - containerPort: 6379
          readinessProbe:
            tcpSocket:
              port: 6379
            periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: redis
spec:
  selector:
    app: redis
  ports:
    - port: 6379
      targetPort: 6379
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: dex-config
data:
  config.yaml: |
    issuer: http://dex.default.svc.cluster.local:5556/dex
    storage:
      type: memory
    web:
      http: 0.0.0.0:5556
    oauth2:
      skipApprovalScreen: true
    staticClients:
      - id: ci-client
        secret: ci-client-secret
        name: CI Client
        redirectURIs:
          - https://patchmon.ci.local/auth/callback
    enablePasswordDB: true
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dex
  labels:
    app: dex
spec:
  replicas: 1
  selector:
    matchLabels:
      app: dex
  template:
    metadata:
      labels:
        app: dex
    spec:
      containers:
        - name: dex
          image: ghcr.io/dexidp/dex:v2.41.1
          command: ["dex", "serve", "/etc/dex/cfg/config.yaml"]
          ports:
            - containerPort: 5556
          readinessProbe:
            httpGet:
              path: /dex/healthz
              port: 5556
            periodSeconds: 5
          volumeMounts:
            - name: config
              mountPath: /etc/dex/cfg
      volumes:
        - name: config
          configMap:
            name: dex-config
---
apiVersion: v1
kind: Service
metadata:
  name: dex
spec:
  selector:
    app: dex
  ports:
    - port: 5556
      targetPort: 5556