helm-charts-hardened/charts/spire/charts/spike-nexus/templates/statefulset.yaml

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ include "spike-nexus.fullname" . }}
  namespace: {{ include "spike-nexus.namespace" . }}
  labels:
    {{- include "spike-nexus.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicas }}
  selector:
    matchLabels:
      {{- include "spike-nexus.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "spike-nexus.selectorLabels" . | nindent 8 }}
        release: {{ .Release.Name }}
        release-namespace: {{ .Release.Namespace }}
        component: spike-nexus
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "spike-nexus.serviceAccountName" . }}
      securityContext:
        {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
      containers:
        - name:  {{ include "spike-nexus.fullname" . }}
          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global "ubi" true) }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- include "spire-lib.securitycontext" . | nindent 12 }}
          ports:
            - name: http
              containerPort: 8443
              protocol: TCP
          env:
            - name: SPIKE_NEXUS_BACKEND_STORE
              value: {{ .Values.backendStore | quote }}
            - name: SPIKE_NEXUS_SHAMIR_SHARES
              value: {{ .Values.shamir.shares | quote }}
            - name: SPIKE_NEXUS_SHAMIR_THRESHOLD
              value: {{ .Values.shamir.threshold | quote }}
            # Note: IP will depend on the testbed.
            - name: SPIKE_NEXUS_KEEPER_PEERS
              {{- if gt (len .Values.keeperPeers) 0 }}
              value: {{ .Values.keeperPeers | join "," | quote }}
              {{- else }}
              value: https://{{ .Release.Name }}-spike-keeper-0.{{ .Release.Name }}-spike-keeper-headless:8443,https://{{ .Release.Name }}-spike-keeper-1.{{ .Release.Name }}-spike-keeper-headless:8443,https://{{ .Release.Name }}-spike-keeper-2.{{ .Release.Name }}-spike-keeper-headless:8443
              {{- end }}
            - name: SPIFFE_ENDPOINT_SOCKET
              value: unix://{{ include "spike-nexus.workload-api-socket-path" . }}
            - name: SPIKE_SYSTEM_LOG_LEVEL
              value: {{ .Values.logLevel | upper }}
            - name: SPIKE_TRUST_ROOT
              value: {{ include "spire-lib.trust-domain" . }}
            - name: SPIKE_TRUST_ROOT_NEXUS
              value: {{ if gt (len .Values.trustRoot.self) 0 }}{{ .Values.trustRoot.self | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
            # required for nexus-bootstrap pop validation
            - name: SPIKE_TRUST_ROOT_BOOTSTRAP
              value: {{ if gt (len .Values.trustRoot.bootstrap) 0 }}{{ .Values.trustRoot.bootstrap | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
            - name: SPIKE_TRUST_ROOT_KEEPER
              value: {{ if gt (len .Values.trustRoot.keeper) 0 }}{{ .Values.trustRoot.keeper | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
            - name: SPIKE_TRUST_ROOT_PILOT
              value: {{ if gt (len .Values.trustRoot.pilot) 0 }}{{ .Values.trustRoot.pilot | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
            - name: SPIKE_NEXUS_TLS_PORT
              value: ":8443"
          {{- if .Values.startupProbe.enabled }}
          startupProbe:
            tcpSocket:
              port: 8443
            failureThreshold: {{ .Values.startupProbe.failureThreshold }}
            initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.startupProbe.periodSeconds }}
            successThreshold: {{ .Values.startupProbe.successThreshold }}
            timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
          {{- end }}
          volumeMounts:
            - name: spiffe-workload-api
              mountPath: {{ include "spike-nexus.workload-api-socket-path" . | dir }}
              readOnly: true
            - name: nexus-data
              mountPath: /.spike
      {{- with .Values.nodeSelector }}

      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
        - name: spiffe-workload-api
          csi:
            driver: "{{ .Values.csiDriverName }}"
            readOnly: true
  volumeClaimTemplates:
    - metadata:
        name: nexus-data
      spec:
        accessModes:
          - {{ .Values.persistence.accessMode | default "ReadWriteOnce" }}
        resources:
          requests:
            storage: {{ .Values.persistence.size }}
        {{- $storageClass := (dig "spire" "persistence" "storageClass" nil .Values.global) | default .Values.persistence.storageClass }}
        {{- if $storageClass }}
        storageClassName: {{ $storageClass }}
        {{- end }}