apiVersion: service.aep.asag.io/v1
kind: Definition
metadata:
  name: defaults-0.0.0-9d4b7bc9
  namespace: asag
spec:
  clusters:
    - name: '*'
      nodes:
        labels:
          ops.aep.asag.io/maintenance: "false"
      provides:
        - flags:
            - from: setting
              key: v1_dns_alt_names
              setting: dns_alt_names
              to: annotation
          name: '*'
          servicespec:
            selector:
              ops.aep.asag.io/maintenance: "false"
          settings:
            - from:
                - user
              name: dns_alt_names
              schema:
                description: Subject Alternative Names for host certificates
                items:
                  format: hostname
                  type: string
                type: array
      topologyqueries:
        - format: array
          groupby:
            - v1_role
          name: members
          scope: instance
  flags:
    - from: setting
      key: v1_clusterid
      setting: clusterid
      to: label
    - from: env
      key: v1_puppetmaster
      to: annotation
    - from: setting
      key: v1_environment
      setting: environment
      to: annotation
    - from: env
      key: v1_datacenter
      to: label
    - from: env
      key: v1_customer_env
      to: annotation
    - from: env
      key: v1_level
      to: label
    - from: setting
      key: puppet_timeout
      setting: puppet_timeout
      to: annotation
  includes:
    - name: lxc
      vendor: asag
      version: 0.0.0-9d4b7bc9
  limits:
    cpu: "2"
    ram: 2Gi
    rootfs: 10Gi
  name: defaults
  onlyinclude: true
  podspec:
    containers:
      - env:
          - name: user-data
            value: |
              #cloud-config
              write_files:
              - path: '/usr/local/sbin/run_puppet.sh'
                permissions: '0750'
                owner: 'root:root'
                content: |
                  #!/bin/bash
                  export LANG='C.UTF-8'
                  export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/puppetlabs/bin'
                  # BUGFIX: remove systemd run directory (created by cloud-init?) when using s6
                  if realpath /sbin/init | grep -Fqx '/etc/s6-linux-init/s6-policy-exclusive/bin/init'; then
                    rm -rf /run/systemd
                  fi
                  DELAY_FINAL_CONFIG="$(grep -oP '^serviceflag\.aep\.asag\.io/delay_final_config="\K[^"]*' /var/lib/aep/podinfo/annotations)"
                  if [ "${DELAY_FINAL_CONFIG,,}" = 'true' ]; then
                    export AEP_HIDE_ROLE='y'
                  fi
                  HOST="$(grep -oP '^dns\.service\.aep\.asag.io/name="\K[^"]*' /var/lib/aep/podinfo/labels)"
                  FQDN="$(grep -oP '^dns\.service\.aep\.asag.io/fqdn="\K[^"]*' /var/lib/aep/podinfo/labels)"
                  ADDR="$(ip -br a s eth0 | awk '{sub(/\/.*/,"",$3); print $3}')"
                  if [ -z "$ADDR" ]; then
                    echo 'Cannot find eth0 IP address.' 1>&2
                    exit 1
                  fi
                  cat <<EOF >/etc/hosts
                  # /etc/hosts
                  127.0.0.1 localhost
                  ${ADDR} ${FQDN} ${HOST}
                  # The following lines are desirable for IPv6 capable hosts
                  ::1 ip6-localhost ip6-loopback
                  fe00::0 ip6-localnet
                  ff00::0 ip6-mcastprefix
                  ff02::1 ip6-allnodes
                  ff02::2 ip6-allrouters
                  ff02::3 ip6-allhosts
                  EOF
                  PUPPETMASTER="$(grep -oP '^serviceflag\.aep\.asag\.io/v1_puppetmaster="\K[^"]*' /var/lib/aep/podinfo/annotations)"
                  ENVIRONMENT="$(grep -oP '^serviceflag\.aep\.asag\.io/v1_environment="\K[^"]*' /var/lib/aep/podinfo/annotations)"
                  #TODO: service can have zero or more endpoints
                  DNS_ALT_NAMES="$(grep -oP '^(dns\.service\.aep\.asag\.io/endpoint\.fqdn\..*|serviceflag\.aep\.asag\.io/.*/v1_dns_alt_names)="\K[^"]*' /var/lib/aep/podinfo/annotations | tr ' \n' ',')"
                  if [ -z "${DNS_ALT_NAMES:-}" ]; then
                    DNS_ALT_NAMES="$FQDN"
                  else
                    DNS_ALT_NAMES="${FQDN},${DNS_ALT_NAMES}"
                  fi
                  cat <<EOF >/etc/puppetlabs/puppet/puppet.conf
                  [main]
                    environment = ${ENVIRONMENT}
                  [agent]
                    server = ${PUPPETMASTER}
                    ca_server = ${PUPPETMASTER}
                    dns_alt_names = ${DNS_ALT_NAMES}
                    preferred_serialization_format = pson
                  EOF
                  chmod 0750 /etc/puppetlabs/puppet/puppet.conf
                  agent_timeout="$(facter v1_aep.puppet_timeout)"
                  if grep -Eq '^serviceflag\.aep\.asag\.io/operator_sshkey=' /var/lib/aep/podinfo/annotations; then
                    grep -oP '^serviceflag\.aep.asag\.io/operator_sshkey="\K[^"]*' /var/lib/aep/podinfo/annotations >/root/.ssh/auth.operator
                  fi
                  for i in {1..10}; do
                    rc='0'
                    echo "iteration: ${i}"
                    apt-get -q -y update >/dev/null
                    puppet agent --enable
                    timeout "$agent_timeout" puppet agent --test && break
                    rc="$?"
                    puppet agent --disable 'initial run'
                    echo "puppet run finished with status $rc"
                    [ "$rc" -eq 1 ] && sleep 30   # another puppet run already in progress
                    rc='1'
                  done
                  if [ "${DELAY_FINAL_CONFIG,,}" = 'true' ]; then
                    rm -f /etc/cron.d/puppet
                    unset AEP_HIDE_ROLE
                    timeout "$agent_timeout" puppet agent --test --noop || true
                  fi
                  exit "$rc"
              runcmd:
              - /usr/local/bin/write_resolvconf.rb
              - /usr/local/sbin/run_puppet.sh
        imagePullPolicy: Always
        name: '*'
        readinessProbe:
          exec:
            command:
              - /usr/local/bin/pod_ready.sh
          failureThreshold: 3
          initialDelaySeconds: 30
          periodSeconds: 10
          successThreshold: 2
          timeoutSeconds: 10
        securityContext:
          privileged: false
        volumeMounts:
          - mountPath: /var/lib/aep/podinfo
            name: aep-podinfo
    volumes:
      - downwardAPI:
          items:
            - fieldRef:
                fieldPath: metadata.labels
              path: labels
            - fieldRef:
                fieldPath: metadata.annotations
              path: annotations
            - fieldRef:
                fieldPath: metadata.name
              path: name
            - fieldRef:
                fieldPath: metadata.namespace
              path: namespace
        name: aep-podinfo
  settings:
    - from:
        - uid
        - user
        - event
      name: clusterid
      required: true
      schema:
        description: for use as clusterid
        type: string
    - from:
        - env
        - user
      name: environment
      required: true
      schema:
        description: the puppet environment
        type: string
    - from:
        - user
      name: puppet_timeout
      schema:
        default: 300
        description: timeout for puppet agent during initial runs
        type: integer
    - from:
        - env
      name: trickid
      required: true
      schema:
        description: the trick identifier
        type: string
  version: 0.0.0-9d4b7bc9
