---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: contracts
  namespace: contracts
spec:
  interval: 10m
  chart:
    spec:
      chart: universal-chart
      version: "0.1.9"
      sourceRef:
        kind: HelmRepository
        name: yc-oci-charts
        namespace: flux-system
      interval: 10m
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    global:
      env: _default
    services:
      contracts:
        enabled: true
        serviceAccount:
          enabled:
            _default: true
          name:
            _default: contracts-vault
        deployment:
          enabled: true
          name:
            _default: backend
          replicaCount:
            _default: 1
          port:
            _default: 8000
          command:
            _default: ["/bin/sh", "-ec"]
          args:
            _default:
              - |
                set -a
                [ -f /vault/secrets/contracts-db ] && . /vault/secrets/contracts-db
                [ -f /vault/secrets/contracts-jwt-public ] && export PUBLIC_KEY="$(cat /vault/secrets/contracts-jwt-public)"
                [ -f /vault/secrets/contracts-rabbitmq ] && . /vault/secrets/contracts-rabbitmq
                [ -f /vault/secrets/contracts-s3 ] && . /vault/secrets/contracts-s3
                [ -f /vault/secrets/contracts-kafka ] && . /vault/secrets/contracts-kafka
                set +a
                exec /usr/local/bin/http
        image:
          name:
            _default: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc
          pullPolicy:
            _default: IfNotPresent
        service:
          enabled: true
          name:
            _default: backend-service
          type:
            _default: ClusterIP
          port:
            _default: 8000
          targetPort:
            _default: 8000
          portName:
            _default: http
        imagePullSecrets:
          enabled:
            _default: true
          name:
            _default: regcred
        envs:
          - name: ADDRESS
            value:
              _default: ":8000"
          - name: ENABLE_SSL
            value:
              _default: "false"
        podAnnotations:
          _default:
            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
            vault.hashicorp.com/agent-init-first: "true"
            vault.hashicorp.com/agent-inject: "true"
            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/auth-path: auth/kubernetes
            vault.hashicorp.com/role: contracts
            vault.hashicorp.com/agent-inject-secret-contracts-db: secrets/data/apps/contracts/postgres
            vault.hashicorp.com/agent-inject-template-contracts-db: |-
              {{- with secret "secrets/data/apps/contracts/postgres" -}}
              DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@postgresql.contracts.svc.cluster.local:5432/contracts_db?sslmode=disable
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-contracts-jwt-public: secrets/data/vault/common/rsa_keys
            vault.hashicorp.com/agent-inject-template-contracts-jwt-public: |-
              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
              {{ index .Data.data "public_key" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-contracts-rabbitmq: secrets/data/rabbitmq/apps/contracts
            vault.hashicorp.com/agent-inject-template-contracts-rabbitmq: |-
              {{- with secret "secrets/data/rabbitmq/apps/contracts" -}}
              CONTRACTS_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
              CONTRACTS_RABBITMQ_USERNAME={{ index .Data.data "username" }}
              CONTRACTS_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
              CONTRACTS_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
              CONTRACTS_RABBITMQ_PORT=5672
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-contracts-s3: secrets/data/minio/apps/contracts
            vault.hashicorp.com/agent-inject-template-contracts-s3: |-
              {{- with secret "secrets/data/minio/apps/contracts" -}}
              CONTRACTS_S3_ENDPOINT={{ index .Data.data.client "endpoint" }}
              CONTRACTS_S3_REGION={{ index .Data.data.client "region" }}
              CONTRACTS_S3_BUCKET=contracts
              CONTRACTS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
              CONTRACTS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-contracts-kafka: secrets/data/kafka/apps/contracts
            vault.hashicorp.com/agent-inject-template-contracts-kafka: |-
              {{- with secret "secrets/data/kafka/apps/contracts" -}}
              CONTRACTS_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }}
              CONTRACTS_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
              CONTRACTS_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
              CONTRACTS_KAFKA_USERNAME={{ index .Data.data "username" }}
              CONTRACTS_KAFKA_PASSWORD={{ index .Data.data "password" }}
              {{- end -}}