# Shared pod spec for web, worker and migration Job.
automountServiceAccountToken: false
restartPolicy: {{ 'OnFailure' if component == 'migrate' else 'Always' }}
{% if www_image_pull_secrets | length %}
imagePullSecrets:
{{ www_image_pull_secrets | to_nice_yaml | indent(2, true) }}
{% endif %}
securityContext:
  runAsNonRoot: true
  runAsUser: 10001
  runAsGroup: 10001
  fsGroup: 10001
  seccompProfile:
    type: RuntimeDefault
containers:
  - name: {{ component }}
    image: {{ www_membership_image | to_json }}
    imagePullPolicy: {{ www_membership_image_pull_policy }}
{% if component == 'migrate' %}
    command: [python, manage.py, migrate, --noinput]
{% elif component == 'worker' %}
    command: [python, manage.py, sync_memberships, --loop, --interval, {{ www_membership_worker_interval | string | to_json }}]
{% endif %}
    envFrom:
      - configMapRef:
          name: membership-config
      - secretRef:
          name: {{ www_membership_secret_name }}
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: [ALL]
    resources:
{{ (www_membership_worker_resources if component == 'worker' else www_membership_resources) | to_nice_yaml | indent(6, true) }}
{% if component == 'web' %}
    ports:
      - name: http
        containerPort: 8000
    startupProbe:
      tcpSocket: {port: http}
      periodSeconds: 5
      failureThreshold: 24
    readinessProbe:
      exec:
        command:
          - python
          - -c
          - {{ ("import http.client; c=http.client.HTTPConnection('127.0.0.1',8000,timeout=3); c.request('GET','/members/',headers={'Host': '" ~ www_hostname ~ "', 'X-Forwarded-Proto': 'https'}); r=c.getresponse(); assert r.status==200; c.close()") | to_json }}
      timeoutSeconds: 5
      periodSeconds: 10
    livenessProbe:
      tcpSocket: {port: http}
      periodSeconds: 20
{% endif %}
    volumeMounts:
      - name: tiers
        mountPath: /etc/membership/tiers
        readOnly: true
      - name: tmp
        mountPath: /tmp
{% if www_membership_ca_secret_name | length %}
      - name: ca
        mountPath: /etc/membership/ca
        readOnly: true
{% endif %}
volumes:
  - name: tiers
    configMap:
      name: membership-tiers
  - name: tmp
    emptyDir:
      sizeLimit: 64Mi
{% if www_membership_ca_secret_name | length %}
  - name: ca
    secret:
      secretName: {{ www_membership_ca_secret_name }}
      defaultMode: 0444
{% endif %}