---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: backend
  namespace: notes
spec:
  interval: 10m
  chart:
    spec:
      chart: universal-chart
      version: "0.1.9"
      sourceRef:
        kind: HelmRepository
        name: yc-oci-charts
        namespace: flux-system
      interval: 10m
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    global:
      env: _default
    services:
      backend:
        enabled: true
        serviceAccount:
          enabled:
            _default: true
          name:
            _default: notes-vault
        deployment:
          enabled: true
          name:
            _default: backend
          replicaCount:
            _default: 1
          port:
            _default: 8000
          command:
            _default: ["/bin/bash", "-c"]
          args:
            _default:
              - |
                set -a
                [ -f /vault/secrets/notes-db ] && source /vault/secrets/notes-db
                [ -f /vault/secrets/notes-django-auth ] && source /vault/secrets/notes-django-auth
                [ -f /vault/secrets/notes-rabbitmq ] && source /vault/secrets/notes-rabbitmq
                [ -f /vault/secrets/notes-s3 ] && source /vault/secrets/notes-s3
                [ -f /vault/secrets/notes-kafka ] && source /vault/secrets/notes-kafka
                set +a
                /bin/bash /opt/entrypoint.sh
          resources:
            requests:
              cpu:
                _default: 25m
              memory:
                _default: 128Mi
          probes:
            liveness:
              enabled: false
            readiness:
              enabled: false
        image:
          name:
            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854
          pullPolicy:
            _default: IfNotPresent
        service:
          enabled: true
          name:
            _default: backend-service
          type:
            _default: ClusterIP
          port:
            _default: 8000
          targetPort:
            _default: 8000
          portName:
            _default: http
        imagePullSecrets:
          enabled:
            _default: true
          name:
            _default: regcred
        envs:
          - name: PG_SSL_MODE
            value:
              _default: verify-full
          - name: DJANGO_HOST
            value:
              _default: https://lk.sarex.io
          - name: BASE_HOST
            value:
              _default: https://api.sarex.io/notes
          - name: TIMEOUT
            value:
              _default: "120"
          - name: FAAS_SERVICE
            value:
              _default: https://api.sarex.io/lambdas
          - name: WORKSPACE_URL
            value:
              _default: https://api.sarex.io/workspaces/api/v1
          - name: WORKFLOW_HOST
            value:
              _default: https://api.sarex.io/workflows/api/v1
          - name: WORKFLOW_TAG
            value:
              _default: stable
          - name: RESOURCE_URL
            value:
              _default: https://api.sarex.io/resources/api/v1
          - name: SYNC_RESOURCE_ID
            value:
              _default: "0"
          - name: ENABLE_ND
            value:
              _default: "0"
          - name: ATTACHMENT_HOST
            value:
              _default: http://attachments-service.attachments.svc.cluster.local:80/api/v1
        podAnnotations:
          _default:
            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
            vault.hashicorp.com/agent-init-first: "true"
            vault.hashicorp.com/agent-inject: "true"
            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/auth-path: auth/kubernetes
            vault.hashicorp.com/role: notes
            vault.hashicorp.com/agent-inject-secret-notes-db: secrets/data/apps/notes/postgres
            vault.hashicorp.com/agent-inject-template-notes-db: |-
              {{- with secret "secrets/data/apps/notes/postgres" -}}
              PG_HOST={{ index .Data.data "host" }}
              PG_PORT={{ index .Data.data "port" }}
              PG_DB={{ index .Data.data "database" }}
              PG_LOGIN={{ index .Data.data "username" }}
              PG_PASSWORD={{ index .Data.data "password" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-notes-django-auth: secrets/data/vault/common/django_auth
            vault.hashicorp.com/agent-inject-template-notes-django-auth: |-
              {{- with secret "secrets/data/vault/common/django_auth" -}}
              DJANGO_TOKEN={{ index .Data.data "key" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-notes-rabbitmq: secrets/data/rabbitmq/apps/notes
            vault.hashicorp.com/agent-inject-template-notes-rabbitmq: |-
              {{- with secret "secrets/data/rabbitmq/apps/notes" -}}
              NOTES_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
              NOTES_RABBITMQ_USERNAME={{ index .Data.data "username" }}
              NOTES_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
              NOTES_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
              NOTES_RABBITMQ_PORT=5672
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-notes-s3: secrets/data/minio/apps/notes
            vault.hashicorp.com/agent-inject-template-notes-s3: |-
              {{- with secret "secrets/data/minio/apps/notes" -}}
              NOTES_S3_ENDPOINT={{ index .Data.data.client "endpoint" }}
              NOTES_S3_REGION={{ index .Data.data.client "region" }}
              NOTES_S3_BUCKET=notes
              NOTES_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
              NOTES_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-notes-kafka: secrets/data/kafka/apps/notes
            vault.hashicorp.com/agent-inject-template-notes-kafka: |-
              {{- with secret "secrets/data/kafka/apps/notes" -}}
              NOTES_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }}
              NOTES_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
              NOTES_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
              NOTES_KAFKA_USERNAME={{ index .Data.data "username" }}
              NOTES_KAFKA_PASSWORD={{ index .Data.data "password" }}
              {{- end -}}