reverse-proxy.dc.yaml

---
apiVersion: v1
kind: Template
labels:
  app: "${APP_NAME}-${JOB_NAME}"
  template: "${APP_NAME}-${JOB_NAME}-reverse-proxy-bc-template"
metadata:
  name: "${APP_NAME}-${JOB_NAME}-reverse-proxy-dc"
objects:
- apiVersion: secops.pathfinder.gov.bc.ca/v1alpha1
  kind: NetworkSecurityPolicy
  metadata:
    name: "${APP_NAME}-${JOB_NAME}-sa-protector-to-k8s-api-${NAMESPACE}"
  spec:
    description: |
      Allow pods to talk to the internal K8S api
    source:
      - - "$namespace=${NAMESPACE}"
        - "@app:k8s:serviceaccountname=deployer"
    destination:
      - - int:network=internal-cluster-api-endpoint
- kind: NetworkSecurityPolicy
  apiVersion: secops.pathfinder.gov.bc.ca/v1alpha1
  metadata:
    name: "${APP_NAME}-${JOB_NAME}-reverse-proxy-to-destinations-${NAMESPACE}"
  spec:
    description: |
      Allow reverse-proxy to connect to frontend, backend and ches-backend
    source:
      - - "$namespace=${NAMESPACE}"
        - "app=${APP_NAME}-${JOB_NAME}"
        - "deploymentconfig=${APP_NAME}-${JOB_NAME}-reverse-proxy"
        - role=reverse-proxy
    destination:
      - - "$namespace=${NAMESPACE}"
        - "app=${APP_NAME}-${JOB_NAME}"
        - role=frontend
      - - "$namespace=${NAMESPACE}"
        - "app=${APP_NAME}-${JOB_NAME}"
        - role=backend
      - - "$namespace=${NAMESPACE}"
        - "app=${APP_NAME}-${JOB_NAME}"
        - role=ches-backend
- apiVersion: v1
  kind: Service
  metadata:
    name: "${APP_NAME}-${JOB_NAME}-reverse-proxy"
  spec:
    ports:
    - name: 2015-tcp
      port: 2015
      protocol: TCP
      targetPort: 2015
    selector:
      app: "${APP_NAME}-${JOB_NAME}"
      deploymentconfig: "${APP_NAME}-${JOB_NAME}-reverse-proxy"
      role: reverse-proxy
    sessionAffinity: None
    type: ClusterIP
- apiVersion: route.openshift.io/v1
  kind: Route
  metadata:
    name: "${APP_NAME}-${JOB_NAME}-reverse-proxy"
  spec:
    host: "${HOST_ROUTE}"
    path: "${PATH_ROOT}"
    port:
      targetPort: 2015-tcp
    tls:
      insecureEdgeTerminationPolicy: Redirect
      termination: edge
    to:
      kind: Service
      name: "${APP_NAME}-${JOB_NAME}-reverse-proxy"
      weight: 100
    wildcardPolicy: None
- apiVersion: apps.openshift.io/v1
  kind: DeploymentConfig
  metadata:
    name: "${APP_NAME}-${JOB_NAME}-reverse-proxy"
  spec:
    replicas: 1
    revisionHistoryLimit: 10
    selector:
      app: "${APP_NAME}-${JOB_NAME}"
      deploymentconfig: "${APP_NAME}-${JOB_NAME}-reverse-proxy"
      role: reverse-proxy
    strategy:
      activeDeadlineSeconds: 21600
      resources: {}
      rollingParams:
        intervalSeconds: 1
        maxSurge: 25%
        maxUnavailable: 25%
        timeoutSeconds: 600
        updatePeriodSeconds: 1
      type: Rolling
    template:
      metadata:
        labels:
          app: "${APP_NAME}-${JOB_NAME}"
          deploymentconfig: "${APP_NAME}-${JOB_NAME}-reverse-proxy"
          role: reverse-proxy
      spec:
        containers:
        - env:
          - name: PATH_ROOT
            value: "${PATH_ROOT}"
          - name: API_SERVICE_NAME
            value: "${APP_NAME}-${JOB_NAME}-backend"
          - name: API_SERVICE_PORT
            value: "8080"
          - name: CHES_SERVICE_NAME
            value: "${APP_NAME}-${JOB_NAME}-ches-backend"
          - name: CHES_SERVICE_PORT
            value: "8888"
          - name: UI_SERVICE_NAME
            value: "${APP_NAME}-${JOB_NAME}-frontend"
          - name: UI_SERVICE_PORT
            value: "2015"
          - name: PROXY_SERVICE_PORT
            value: "2015"
          image: "docker-registry.default.svc:5000/${NAMESPACE}/${REPO_NAME}-reverse-proxy:${JOB_NAME}"
          imagePullPolicy: Always
          # livenessProbe:
          #  failureThreshold: 3
          #  httpGet:
          #    path: "${PATH_ROOT}"
          #    port: 2015
          #    scheme: HTTP
          #  periodSeconds: 10
          #  successThreshold: 1
          #  timeoutSeconds: 10
          name: "${APP_NAME}-${JOB_NAME}-reverse-proxy"
          ports:
          - containerPort: 2015
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: "${PATH_ROOT}"
              port: 2015
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 10
          resources:
            requests:
              cpu: "${CPU_REQUEST}"
              memory: "${MEMORY_REQUEST}"
            limits:
              cpu: "${CPU_LIMIT}"
              memory: "${MEMORY_LIMIT}"
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        terminationGracePeriodSeconds: 30
    test: false
parameters:
- name: REPO_NAME
  description: Application repository name
  required: true
- name: JOB_NAME
  description: Job identifier (i.e. 'pr-5' OR 'master')
  required: true
- name: NAMESPACE
  description: Target namespace reference (i.e. 'k8vopl-dev')
  required: true
- name: APP_NAME
  description: Application name
  required: true
- name: CPU_REQUEST
  description: Requested CPU per pod (in millicores ex. 500m)
  required: true
  value: 100m
- name: MEMORY_REQUEST
  description: Requested Memory per pod (in gigabytes Gi or megabytes Mi ex. 500Mi)
  required: true
  value: 256Mi
- name: CPU_LIMIT
  description: Limit Peak CPU per pod (in millicores ex. 1000m)
  required: true
  value: 500m
- name: MEMORY_LIMIT
  description: Limit Peak Memory per pod (in gigabytes Gi or megabytes Mi ex. 2Gi)
  required: true
  value: 1Gi
- name: HOST_ROUTE
  description: The host the route will use to expose service outside cluster
  required: true
- name: PATH_ROOT
  description: Root of path where application is hosted (ex. '/pr-5' or '/mssc')
  required: true
  value: "/mssc"