connectivity-deployment.yaml

# Copyright (c) 2023 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Eclipse Public License 2.0 which is available at
# http://www.eclipse.org/legal/epl-2.0
#
# SPDX-License-Identifier: EPL-2.0
{{- if .Values.connectivity.enabled -}}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "ditto.fullname" . }}-connectivity
  labels:
    app.kubernetes.io/name: {{ include "ditto.name" . }}-connectivity
{{ include "ditto.labels" . | indent 4 }}
spec:
  replicas: {{ .Values.connectivity.replicaCount }}
  strategy:
  {{- with .Values.connectivity.updateStrategy }}
  {{- toYaml . | nindent 4 }}
  {{- end }}
  minReadySeconds: {{ .Values.connectivity.minReadySeconds }}
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ include "ditto.name" . }}-connectivity
      app.kubernetes.io/instance: {{ .Release.Name }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ include "ditto.name" . }}-connectivity
        app.kubernetes.io/instance: {{ .Release.Name }}
        actorSystemName: {{ .Values.akka.actorSystemName }}
        {{- with .Values.connectivity.additionalLabels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      annotations:
        {{- if .Values.global.prometheus.enabled }}
        prometheus.io/scrape: "true"
        prometheus.io/path: "{{ .Values.global.prometheus.path }}"
        prometheus.io/port: "{{ .Values.global.prometheus.port }}"
        {{- end }}
        checksum/mongodb-config: {{ include (print $.Template.BasePath "/mongodb-secret.yaml") . | sha256sum }}
        {{- with .Values.connectivity.additionalAnnotations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      {{- if .Values.rbac.enabled }}
      serviceAccountName: {{ template "ditto.serviceAccountName" . }}
      {{- end }}
      {{- with .Values.global.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      securityContext:
        fsGroup: 1000
      initContainers:
        {{- if .Values.global.logging.logFiles.enabled }}
        - name: change-volume-owner
          image: busybox
          securityContext:
            runAsUser: 0
          command: [ "sh", "-c", "chown -R 1000:1000 /var/log/ditto && echo 'changed ownership of /var/log/ditto to 1000:1000'" ]
          volumeMounts:
            - name: ditto-log-files-directory
              mountPath: /var/log/ditto
        {{- end }}
      topologySpreadConstraints:
        - maxSkew: {{ .Values.connectivity.topologySpreadConstraints.maxSkew }}
          topologyKey: {{ .Values.connectivity.topologySpreadConstraints.topologyKey }}
          whenUnsatisfiable: {{ .Values.connectivity.topologySpreadConstraints.whenUnsatisfiable }}
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: {{ include "ditto.name" . }}-connectivity
      containers:
        - name: {{ .Chart.Name }}-connectivity
          image: {{ printf "%s:%s" .Values.connectivity.image.repository ( default .Chart.AppVersion ( default .Values.dittoTag .Values.connectivity.image.tag ) ) }}
          imagePullPolicy: {{ .Values.connectivity.image.pullPolicy }}
          env:
            {{- if not .Values.global.logging.customConfigFile.enabled }}
            - name: DITTO_LOGGING_DISABLE_SYSOUT_LOG
              value: "{{ if .Values.global.logging.sysout.enabled }}false{{ else }}true{{ end }}"
            - name: DITTO_LOGGING_FILE_APPENDER
              value: "{{ if .Values.global.logging.logFiles.enabled }}true{{ else }}false{{ end }}"
            {{- end }}
            - name: DITTO_TRACING_ENABLED
              value: "{{ .Values.global.tracing.enabled }}"
            - name: OTEL_EXPORTER_OTLP_ENDPOINT
              value: "{{ tpl .Values.global.tracing.otelExporterOtlpEndpoint . }}"
            - name: DITTO_TRACING_SAMPLER
              value: "{{ .Values.global.tracing.sampler }}"
            - name: DITTO_TRACING_RANDOM_SAMPLER_PROBABILITY
              value: "{{ .Values.global.tracing.randomSampler.probability }}"
            - name: DITTO_TRACING_ADAPTIVE_SAMPLER_THROUGHPUT
              value: "{{ .Values.global.tracing.adaptiveSampler.throughput }}"
            {{- if .Values.global.logging.logstash.enabled }}
            - name: DITTO_LOGGING_LOGSTASH_SERVER
              value: "{{ .Values.global.logging.logstash.endpoint }}"
            {{- end }}
            - name: POD_LABEL_SELECTOR
              value: "app.kubernetes.io/name=%s"
            - name: POD_NAMESPACE
              value: {{ .Release.Namespace }}
            - name: INSTANCE_INDEX
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: status.podIP
            - name: DISCOVERY_METHOD
              value: "kubernetes-api"
            - name: TZ
              value: "{{ .Values.global.timezone }}"
            - name: JAVA_TOOL_OPTIONS
              value: >
                {{ .Values.global.jvmOptions }}
                -XX:ActiveProcessorCount={{ .Values.connectivity.jvm.activeProcessorCount }}
                -XX:MaxRAMPercentage={{ .Values.connectivity.jvm.heapRamPercentage }}
                -XX:InitialRAMPercentage={{ .Values.connectivity.jvm.heapRamPercentage }}
                -XX:MaxGCPauseMillis={{ .Values.connectivity.jvm.maxGcPauseMillis }}
                {{ .Values.connectivity.additionalJvmOptions }}
                {{- .Values.global.akkaOptions }}
                {{- if .Values.global.logging.customConfigFile.enabled }}
                -Dlogback.configurationFile=/opt/ditto/{{ .Values.global.logging.customConfigFile.fileName }}
                {{- end }}
                {{- range $index, $header := .Values.connectivity.config.persistence.events.historicalHeadersToPersist }}
                "{{ printf "%s%d=%s" "-Dditto.connectivity.connection.event.historical-headers-to-persist." $index $header }}"
                {{- end }}
                {{ join " " .Values.connectivity.systemProps }}
            - name: MONGO_DB_SSL_ENABLED
              value: "{{ if .Values.dbconfig.connectivity.ssl }}true{{ else }}false{{ end }}"
            - name: MONGO_DB_URI
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.dbconfig.uriSecret | default ( printf "%s-mongodb-secret" ( include "ditto.fullname" . )) }}
                  key: connectivity-uri
            - name: MONGO_DB_CONNECTION_MIN_POOL_SIZE
              value: "{{ .Values.connectivity.config.mongodb.minPoolSize }}"
            - name: MONGO_DB_CONNECTION_POOL_SIZE
              value: "{{ .Values.connectivity.config.mongodb.maxPoolSize }}"
            - name: MONGO_DB_CONNECTION_POOL_IDLE_TIME
              value: "{{ .Values.connectivity.config.mongodb.maxPoolIdleTime }}"
            - name: CLUSTER_BS_REQUIRED_CONTACTS
              value: "{{ .Values.global.cluster.requiredContactPoints }}"
            - name: DITTO_DDATA_NUMBER_OF_SHARDS
              value: "{{ .Values.global.cluster.ddata.numberOfShards }}"
            - name: DITTO_DDATA_MAX_DELTA_ELEMENTS
              value: "{{ .Values.global.cluster.ddata.maxDeltaElements }}"
            - name: CLUSTER_NUMBER_OF_SHARDS
              value: "{{ .Values.global.cluster.numberOfShards }}"
            - name: CLUSTER_DOWNING_STABLE_AFTER
              value: "{{ .Values.global.cluster.downingStableAfter }}"
            - name: CLUSTER_DOWNING_DOWN_ALL_WHEN_UNSTABLE
              value: "{{ .Values.global.cluster.downAllWhenUnstable }}"
            {{- if .Values.global.prometheus.enabled }}
            - name: PROMETHEUS_PORT
              value: "{{ .Values.global.prometheus.port }}"
            {{- end }}
            - name: REMOTE_MAX_FRAMESIZE
              value: "{{ .Values.global.limits.akkaClusterMaxFramesize }}"
            - name: LIMITS_THINGS_MAX_SIZE
              value: "{{ .Values.global.limits.thingsMaxSize }}"
            - name: LIMITS_POLICIES_MAX_SIZE
              value: "{{ .Values.global.limits.policiesMaxSize }}"
            - name: LIMITS_POLICIES_MAX_IMPORTS
              value: "{{ .Values.global.limits.policiesMaxImports }}"
            - name: LIMITS_MESSAGES_MAX_SIZE
              value: "{{ .Values.global.limits.messagesMaxSize }}"
            - name: LIMITS_MESSAGES_HEADERS_SIZE
              value: "{{ .Values.global.limits.maxHeadersSize }}"
            - name: LIMITS_MESSAGES_AUTH_SUBJECTS_COUNT
              value: "{{ .Values.global.limits.maxAuthSubjectsCount }}"
            - name: AKKA_PERSISTENCE_MONGO_JOURNAL_WRITE_CONCERN
              value: "{{ .Values.connectivity.config.mongodb.journalWriteConcern }}"
            - name: AKKA_PERSISTENCE_MONGO_SNAPS_WRITE_CONCERN
              value: "{{ .Values.connectivity.config.mongodb.snapsWriteConcern }}"
            - name: BREAKER_MAXTRIES
              value: "{{ .Values.connectivity.config.mongodb.journalCircuitBreaker.maxTries }}"
            - name: BREAKER_TIMEOUT
              value: "{{ .Values.connectivity.config.mongodb.journalCircuitBreaker.timeout }}"
            - name: BREAKER_RESET
              value: "{{ .Values.connectivity.config.mongodb.journalCircuitBreaker.reset }}"
            - name: SNAPSHOT_BREAKER_MAXTRIES
              value: "{{ .Values.connectivity.config.mongodb.snapsCircuitBreaker.maxTries }}"
            - name: SNAPSHOT_BREAKER_TIMEOUT
              value: "{{ .Values.connectivity.config.mongodb.snapsCircuitBreaker.timeout }}"
            - name: SNAPSHOT_BREAKER_RESET
              value: "{{ .Values.connectivity.config.mongodb.snapsCircuitBreaker.reset }}"
            - name: CONNECTION_ACTIVITY_CHECK_INTERVAL
              value: "{{ .Values.connectivity.config.persistence.activityCheckInterval }}"
            - name: HEALTH_CHECK_METRICS_REPORTER_RESOLUTION
              value: "{{ .Values.connectivity.config.cleanup.metricsReporter.resolution }}"
            - name: HEALTH_CHECK_METRICS_REPORTER_HISTORY
              value: "{{ .Values.connectivity.config.cleanup.metricsReporter.history }}"
            - name: CLEANUP_ENABLED
              value: "{{ .Values.connectivity.config.cleanup.enabled }}"
            - name: CLEANUP_QUIET_PERIOD
              value: "{{ .Values.connectivity.config.cleanup.quietPeriod }}"
            - name: CLEANUP_HISTORY_RETENTION_DURATION
              value: "{{ .Values.connectivity.config.cleanup.history.retentionDuration }}"
            - name: CLEANUP_INTERVAL
              value: "{{ .Values.connectivity.config.cleanup.interval }}"
            - name: CLEANUP_TIMER_THRESHOLD
              value: "{{ .Values.connectivity.config.cleanup.timerThreshold }}"
            - name: CLEANUP_CREDITS_PER_BATCH
              value: "{{ .Values.connectivity.config.cleanup.creditsPerBatch }}"
            - name: CONNECTION_SNAPSHOT_INTERVAL
              value: "{{ .Values.connectivity.config.persistence.snapshots.interval }}"
            - name: CONNECTION_SNAPSHOT_THRESHOLD
              value: "{{ .Values.connectivity.config.persistence.snapshots.threshold }}"
            - name: DITTO_POLICIES_ENFORCER_CACHE_ENABLED
              value: "{{ .Values.connectivity.config.policiesEnforcer.cache.enabled }}"
            - name: DITTO_POLICIES_ENFORCER_CACHE_MAX_SIZE
              value: "{{ .Values.connectivity.config.policiesEnforcer.cache.maxSize }}"
            - name: DITTO_POLICIES_ENFORCER_CACHE_EXPIRE_AFTER_WRITE
              value: "{{ .Values.connectivity.config.policiesEnforcer.cache.expireAfterWrite }}"
            - name: DITTO_POLICIES_ENFORCER_CACHE_EXPIRE_AFTER_ACCESS
              value: "{{ .Values.connectivity.config.policiesEnforcer.cache.expireAfterAccess }}"
            - name: RECONNECT_RATE_FREQUENCY
              value: "{{ .Values.connectivity.config.connections.reconnect.rate.frequency }}"
            - name: RECONNECT_RATE_ENTITIES
              value: "{{ .Values.connectivity.config.connections.reconnect.rate.entities }}"
            - name: CONNECTIVITY_CONNECTION_ALLOWED_HOSTNAMES
              value: "{{ .Values.connectivity.config.connections.allowedHostnames }}"
            - name: CONNECTIVITY_CONNECTION_BLOCKED_HOSTNAMES
              value: "{{ .Values.connectivity.config.connections.blockedHostnames }}"
            - name: CONNECTIVITY_CONNECTION_BLOCKED_SUBNETS
              value: "{{ .Values.connectivity.config.connections.blockedSubnets }}"
            - name: CONNECTIVITY_CONNECTION_BLOCKED_HOST_REGEX
              value: "{{ .Values.connectivity.config.connections.blockedHostRegex }}"
            - name: CONNECTION_SOURCE_NUMBER
              value: "{{ .Values.connectivity.config.connections.limits.maxSources }}"
            - name: CONNECTION_TARGET_NUMBER
              value: "{{ .Values.connectivity.config.connections.limits.maxTargets }}"
            - name: CONNECTIVITY_SIGNAL_ENRICHMENT_BUFFER_SIZE
              value: "{{ .Values.connectivity.config.connections.enrichment.bufferSize }}"
            - name: KAFKA_CONSUMER_THROTTLING_ENABLED
              value: "{{ .Values.connectivity.config.connections.kafka.consumer.throttling.enabled }}"
            - name: KAFKA_CONSUMER_THROTTLING_INTERVAL
              value: "{{ .Values.connectivity.config.connections.kafka.consumer.throttling.interval }}"
            - name: KAFKA_CONSUMER_THROTTLING_LIMIT
              value: "{{ .Values.connectivity.config.connections.kafka.consumer.throttling.limit }}"
            - name: KAFKA_CONSUMER_THROTTLING_MAX_IN_FLIGHT_FACTOR
              value: "{{ .Values.connectivity.config.connections.kafka.consumer.throttling.maxInflightFactor }}"
            - name: KAFKA_PRODUCER_QUEUE_SIZE
              value: "{{ .Values.connectivity.config.connections.kafka.producer.queueSize }}"
            - name: KAFKA_PRODUCER_PARALLELISM
              value: "{{ .Values.connectivity.config.connections.kafka.producer.parallelism }}"
            {{- if .Values.connectivity.extraEnv }}
              {{- toYaml .Values.connectivity.extraEnv | nindent 12 }}
            {{- end }}
          ports:
            - name: remoting
              containerPort: {{ .Values.akka.remoting.port }}
              protocol: TCP
            - name: management
              containerPort: {{ .Values.akka.mgmthttp.port }}
              protocol: TCP
            {{- if .Values.global.prometheus.enabled }}
            - name: prometheus
              protocol: TCP
              containerPort: {{ .Values.global.prometheus.port }}
            {{- end }}
          readinessProbe:
            httpGet:
              port: management
              path: /ready
            initialDelaySeconds: {{ .Values.connectivity.readinessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.connectivity.readinessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.connectivity.readinessProbe.timeoutSeconds }}
            successThreshold: {{ .Values.connectivity.readinessProbe.successThreshold }}
            failureThreshold: {{ .Values.connectivity.readinessProbe.failureThreshold }}
          livenessProbe:
            httpGet:
              port: management
              path: /alive
            initialDelaySeconds: {{ .Values.connectivity.livenessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.connectivity.livenessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.connectivity.livenessProbe.timeoutSeconds }}
            successThreshold: {{ .Values.connectivity.livenessProbe.successThreshold }}
            failureThreshold: {{ .Values.connectivity.livenessProbe.failureThreshold }}
          volumeMounts:
            {{- if .Values.global.logging.customConfigFile.enabled }}
            - name: ditto-custom-log-config
              mountPath: /opt/ditto/{{ .Values.global.logging.customConfigFile.fileName }}
              subPath: {{ .Values.global.logging.customConfigFile.fileName }}
            {{- end }}
            {{- if .Values.global.logging.logFiles.enabled }}
            - name: ditto-log-files-directory
              mountPath: /var/log/ditto
            {{- end }}
          resources:
            requests:
              cpu: {{ mulf .Values.connectivity.resources.cpu 1000 }}m
              memory: {{ .Values.connectivity.resources.memoryMi }}Mi
            limits:
              # ## no cpu limit to avoid CFS scheduler limits
              # ref: https://doc.akka.io/docs/akka/snapshot/additional/deploy.html#in-kubernetes
              # cpu: ""
              memory: {{ .Values.connectivity.resources.memoryMi }}Mi
          {{- if .Values.openshift.enabled }}
          {{- with .Values.openshift.securityContext }}
          securityContext:
            {{- toYaml . | nindent 8 }}
          {{- end }}
          {{- else }}
          securityContext:
            runAsNonRoot: true
            runAsUser: 1000
            runAsGroup: 1000
            allowPrivilegeEscalation: false
          {{- end }}
      {{- with .Values.connectivity.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.connectivity.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.connectivity.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
        {{- if .Values.global.logging.customConfigFile.enabled }}
        - name: ditto-custom-log-config
          configMap:
            name: {{ .Release.Name }}-logback-config-connectivity-xml
        {{- end }}
        {{- if .Values.global.logging.logFiles.enabled }}
        - name: ditto-log-files-directory
          hostPath:
            path: /var/log/ditto
            type: DirectoryOrCreate
        {{- end }}
{{- end }}