---
# Source: opensearch/templates/poddisruptionbudget.yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: "brilliant-opensearch-cluster-master-pdb"
  labels:
    helm.sh/chart: opensearch-3.7.0
    app.kubernetes.io/name: opensearch
    app.kubernetes.io/instance: brilliant-opensearch
    app.kubernetes.io/version: "3.7.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: brilliant-opensearch-cluster-master
spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: opensearch
      app.kubernetes.io/instance: brilliant-opensearch
---
# Source: opensearch/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: brilliant-opensearch-cluster-master-config
  labels:
    helm.sh/chart: opensearch-3.7.0
    app.kubernetes.io/name: opensearch
    app.kubernetes.io/instance: brilliant-opensearch
    app.kubernetes.io/version: "3.7.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: brilliant-opensearch-cluster-master
data:
  opensearch.yml: |
    cluster.name: brilliant-opensearch-cluster
    
    # Bind to all interfaces because we don't know what IP address Docker will assign to us.
    network.host: 0.0.0.0
    
    # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
    # Implicitly done if ".singleNode" is set to "true".
    # discovery.type: single-node
    
    # Start OpenSearch Security Demo Configuration
    # WARNING: revise all the lines below before you go into production
    plugins:
      security:
        nodes_dn:
        - "CN=opensearch-master-0,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
        - "CN=opensearch-master-1,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
        - "CN=opensearch-master-2,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"     
        ssl:
          transport:
            pemcert_filepath: certs/node.pem
            pemkey_filepath: certs/node-key.pem
            pemtrustedcas_filepath: certs/root-ca.pem
            enforce_hostname_verification: true
            resolve_hostname: true
          http:
            enabled: true
            pemcert_filepath: certs/node.pem
            pemkey_filepath: certs/node-key.pem
            pemtrustedcas_filepath: certs/root-ca.pem
        allow_unsafe_democertificates: false
        allow_default_init_securityindex: true
        authcz:
          admin_dn:
            - CN=opensearch-admin,OU=OpenSearch Administrators,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD
        audit.type: internal_opensearch
        enable_snapshot_restore_privilege: true
        check_snapshot_restore_write_privileges: true
        restapi:
          roles_enabled: ["all_access", "security_rest_api_access"]
        system_indices:
          enabled: true
          indices:
            [
              ".opendistro-alerting-config",
              ".opendistro-alerting-alert*",
              ".opendistro-anomaly-results*",
              ".opendistro-anomaly-detector*",
              ".opendistro-anomaly-checkpoints",
              ".opendistro-anomaly-detection-state",
              ".opendistro-reports-*",
              ".opendistro-notifications-*",
              ".opendistro-notebooks",
              ".opendistro-asynchronous-search-response*",
            ]
    ######## End OpenSearch Security Demo Configuration ########
---
# Source: opensearch/templates/service.yaml
kind: Service
apiVersion: v1
metadata:
  name: brilliant-opensearch-cluster-master
  labels:
    helm.sh/chart: opensearch-3.7.0
    app.kubernetes.io/name: opensearch
    app.kubernetes.io/instance: brilliant-opensearch
    app.kubernetes.io/version: "3.7.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: brilliant-opensearch-cluster-master
  annotations:
    {}
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: opensearch
    app.kubernetes.io/instance: brilliant-opensearch
  ports:
  - name: http
    protocol: TCP
    port: 9200
  - name: transport
    protocol: TCP
    port: 9300
  - name: metrics
    protocol: TCP
    port: 9600
---
# Source: opensearch/templates/service.yaml
kind: Service
apiVersion: v1
metadata:
  name: brilliant-opensearch-cluster-master-headless
  labels:
    helm.sh/chart: opensearch-3.7.0
    app.kubernetes.io/name: opensearch
    app.kubernetes.io/instance: brilliant-opensearch
    app.kubernetes.io/version: "3.7.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: brilliant-opensearch-cluster-master
  annotations:
    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
spec:
  clusterIP: None # This is needed for statefulset hostnames like opensearch-0 to resolve
  # Create endpoints also if the related pod isn't ready
  publishNotReadyAddresses: true
  selector:
    app.kubernetes.io/name: opensearch
    app.kubernetes.io/instance: brilliant-opensearch
  ports:
  - name: http
    port: 9200
  - name: transport
    port: 9300
  - name: metrics
    port: 9600
---
# Source: opensearch/templates/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: brilliant-opensearch-cluster-master
  labels:
    helm.sh/chart: opensearch-3.7.0
    app.kubernetes.io/name: opensearch
    app.kubernetes.io/instance: brilliant-opensearch
    app.kubernetes.io/version: "3.7.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: brilliant-opensearch-cluster-master
  annotations:
    majorVersion: "3"
spec:
  serviceName: brilliant-opensearch-cluster-master-headless
  selector:
    matchLabels:
      app.kubernetes.io/name: opensearch
      app.kubernetes.io/instance: brilliant-opensearch
  replicas: 3
  podManagementPolicy: Parallel
  updateStrategy:
    type: RollingUpdate
  volumeClaimTemplates:
  - metadata:
      name: brilliant-opensearch-cluster-master
    spec:
      accessModes:
      - "ReadWriteOnce"
      resources:
        requests:
          storage: "120Gi"
      storageClassName: "longhorn"
  template:
    metadata:
      name: "brilliant-opensearch-cluster-master"
      labels:
        helm.sh/chart: opensearch-3.7.0
        app.kubernetes.io/name: opensearch
        app.kubernetes.io/instance: brilliant-opensearch
        app.kubernetes.io/version: "3.7.0"
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: brilliant-opensearch-cluster-master
      annotations:
        configchecksum: 695bb69d8226ee092a4062e8f2e3c1f5fd7f6ed596b739cdd7dd9dcb60249ff
    spec:
      securityContext:
        fsGroup: 1000
        runAsUser: 1000
      automountServiceAccountToken: false
      tolerations:
      - effect: NoSchedule
        key: dedicated
        operator: Equal
        value: storage
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app.kubernetes.io/instance
                operator: In
                values:
                - brilliant-opensearch
              - key: app.kubernetes.io/name
                operator: In
                values:
                - opensearch
            topologyKey: kubernetes.io/hostname
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/hostname
                operator: NotIn
                values:
                - k8s-cp-01
      terminationGracePeriodSeconds: 120
      volumes:
      - name: config
        configMap:
          name: brilliant-opensearch-cluster-master-config
      - emptyDir: {}
        name: config-emptydir
      # Currently some extra blocks accept strings
      # to continue with backwards compatibility this is being kept
      # whilst also allowing for yaml to be specified too.
      - name: node-0-source
        secret:
          defaultMode: 288
          secretName: opensearch-node-0-cert
      - name: node-1-source
        secret:
          defaultMode: 288
          secretName: opensearch-node-1-cert
      - name: node-2-source
        secret:
          defaultMode: 288
          secretName: opensearch-node-2-cert
      - emptyDir: {}
        name: runtime-certs
      enableServiceLinks: true
      initContainers:
      - name: fsgroup-volume
        image: "busybox:latest"
        imagePullPolicy: "IfNotPresent"
        command: ['sh', '-c']
        args:
          - 'chown -R 1000:1000 /usr/share/opensearch/data'
        securityContext:
          runAsUser: 0
        resources:
          {}
        volumeMounts:
          - name: "brilliant-opensearch-cluster-master"
            mountPath: /usr/share/opensearch/data
      - name: sysctl
        image: "busybox:latest"
        imagePullPolicy: "IfNotPresent"
        command:
        - sh
        - -c
        - |
          set -xe
          DESIRED="262144"
          CURRENT=$(sysctl -n vm.max_map_count)
          if [ "$DESIRED" -gt "$CURRENT" ]; then
            sysctl -w vm.max_map_count=$DESIRED
          fi
        securityContext:
          runAsUser: 0
          privileged: true
        resources:
          {}
      - name: configfile
        image: "opensearchproject/opensearch:3.7.0"
        imagePullPolicy: "IfNotPresent"
        command:
        - sh
        - -c
        - |
          #!/usr/bin/env bash
          cp -r /tmp/configfolder/*  /tmp/config/
        securityContext:
          capabilities:
            drop:
            - ALL
          runAsNonRoot: true
          runAsUser: 1000
        resources:
          {}
        volumeMounts:
          - mountPath: /tmp/config/
            name: config-emptydir
          - name: config
            mountPath: /tmp/configfolder/opensearch.yml
            subPath: opensearch.yml
      # Currently some extra blocks accept strings
      # to continue with backwards compatibility this is being kept
      # whilst also allowing for yaml to be specified too.
      - command:
        - /bin/sh
        - -ec
        - |
          ordinal="${POD_NAME##*-}"
      
          case "${ordinal}" in
            0|1|2)
              ;;
            *)
              echo "ERROR: unsupported pod name: ${POD_NAME}"
              exit 1
              ;;
          esac
      
          source_dir="/source/node-${ordinal}"
          cert="${source_dir}/node-${ordinal}.pem"
          key="${source_dir}/node-${ordinal}-key.pem"
          ca="${source_dir}/root-ca.pem"
      
          test -r "${cert}" || {
            echo "ERROR: certificate not readable: ${cert}"
            exit 1
          }
      
          test -r "${key}" || {
            echo "ERROR: private key not readable: ${key}"
            exit 1
          }
      
          test -r "${ca}" || {
            echo "ERROR: root CA not readable: ${ca}"
            exit 1
          }
      
          cp "${cert}" /runtime/node.pem
          cp "${key}" /runtime/node-key.pem
          cp "${ca}" /runtime/root-ca.pem
      
          chmod 0644 /runtime/node.pem
          chmod 0600 /runtime/node-key.pem
          chmod 0644 /runtime/root-ca.pem
      
          echo "Selected node-${ordinal} certificate for ${POD_NAME}"
          ls -l /runtime
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: busybox:1.36.1
        imagePullPolicy: IfNotPresent
        name: select-node-certificate
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsGroup: 1000
          runAsNonRoot: true
          runAsUser: 1000
        volumeMounts:
        - mountPath: /source/node-0
          name: node-0-source
          readOnly: true
        - mountPath: /source/node-1
          name: node-1-source
          readOnly: true
        - mountPath: /source/node-2
          name: node-2-source
          readOnly: true
        - mountPath: /runtime
          name: runtime-certs
      containers:
      - name: "opensearch"
        securityContext:
          capabilities:
            drop:
            - ALL
          runAsNonRoot: true
          runAsUser: 1000

        image: "opensearchproject/opensearch:3.7.0"
        imagePullPolicy: "IfNotPresent"
        readinessProbe:
          failureThreshold: 3
          periodSeconds: 5
          tcpSocket:
            port: 9200
          timeoutSeconds: 3
        startupProbe:
          failureThreshold: 30
          initialDelaySeconds: 5
          periodSeconds: 10
          tcpSocket:
            port: 9200
          timeoutSeconds: 3
        ports:
        - name: http
          containerPort: 9200
        - name: transport
          containerPort: 9300
        - name: metrics
          containerPort: 9600
        resources:
          limits:
            cpu: "4"
            memory: 8Gi
          requests:
            cpu: "2"
            memory: 6Gi
        env:
        - name: node.name
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: cluster.initial_master_nodes
          value: "brilliant-opensearch-cluster-master-0,brilliant-opensearch-cluster-master-1,brilliant-opensearch-cluster-master-2,"
        - name: discovery.seed_hosts
          value: "brilliant-opensearch-cluster-master-headless"
        - name: cluster.name
          value: "brilliant-opensearch-cluster"
        - name: network.host
          value: "0.0.0.0"
        - name: OPENSEARCH_JAVA_OPTS
          value: "-Xmx3G -Xms3G"
        - name: node.roles
          value: "master,ingest,data,remote_cluster_client,"
        envFrom:
        - secretRef:
            name: opensearch-secret
        volumeMounts:
        - name: "brilliant-opensearch-cluster-master"
          mountPath: /usr/share/opensearch/data
        - name: config-emptydir
          mountPath: /usr/share/opensearch/config/opensearch.yml
          subPath: opensearch.yml
        # Currently some extra blocks accept strings
        # to continue with backwards compatibility this is being kept
        # whilst also allowing for yaml to be specified too.
        - mountPath: /usr/share/opensearch/config/certs
          name: runtime-certs
          readOnly: true