package templates
import (
appsv1 "k8s.io/api/apps/v1"
corev1 "k8s.io/api/core/v1"
)
#StatefulSet: appsv1.#StatefulSet & {
#config: #Config
#name: string
#group: #NodeGroup
#cmName: string
apiVersion: "apps/v1"
kind: "StatefulSet"
metadata: (#config.#Meta & {name: #name}).out
spec: appsv1.#StatefulSetSpec & {
serviceName: #group.role
replicas: #group.replicas
selector: matchLabels: {
"app": "radicle-node"
"instance": #name
}
template: {
metadata: labels: {
"app": "radicle-node"
"role": #group.role
"instance": #name
}
spec: corev1.#PodSpec & {
securityContext: {
fsGroup: 11011
seccompProfile: type: "RuntimeDefault"
runAsNonRoot: true
runAsUser: 11011
runAsGroup: 11011
}
initContainers: [
{
name: "config-prep"
image: "busybox"
command: ["sh", "-c"]
args: [#group.scripts.init]
volumeMounts: [
{
name: "config-template"
mountPath: "/tmp/config-source"
},
{
name: "radicle-home"
mountPath: "/home/radicle/.radicle"
},
]
securityContext: {
runAsUser: 11011
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities: drop: ["ALL"]
seccompProfile: type: "RuntimeDefault"
}
},
]
containers: [
{
name: "node"
image: "\(#group.repository):\(#group.version)"
imagePullPolicy: #group.pullPolicy
command: ["/bin/sh", "-c"]
args: [#group.scripts.start]
env: [
{
name: "RAD_PASSPHRASE"
value: ""
},
{
name: "NODE_ID_SEED"
value: #group.nodeIdSeed
},
]
securityContext: {
allowPrivilegeEscalation: false
capabilities: drop: ["ALL"]
privileged: false
readOnlyRootFilesystem: false
}
ports: [
{
containerPort: 8776
name: "gossip"
},
]
volumeMounts: [
{
name: "radicle-home"
mountPath: "/home/radicle/.radicle"
},
]
},
if #group.sidecars.events {
{
name: "events"
image: "\(#group.repository):\(#group.version)"
command: ["/bin/sh", "-c"]
args: [#group.scripts.events]
securityContext: {
runAsNonRoot: true
runAsUser: 11011
runAsGroup: 11011
allowPrivilegeEscalation: false
capabilities: drop: ["ALL"]
readOnlyRootFilesystem: false
}
volumeMounts: [
{
name: "radicle-home"
mountPath: "/home/radicle/.radicle"
},
]
}
},
]
volumes: [
{
name: "config-template"
configMap: name: #cmName
},
]
}
}
volumeClaimTemplates: [
{
metadata: {
name: "radicle-home"
labels: {
"app": "radicle-node"
"role": #group.role
"instance": #name
}
}
spec: {
storageClassName: #group.storage.className
accessModes: ["ReadWriteOnce"]
resources: requests: storage: #group.storage.size
}
},
]
}
}