kessel-relations-deploy.yaml

apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: relations
objects:
  - apiVersion: authzed.com/v1alpha1
    kind: SpiceDBCluster
    metadata:
      name: ${CLOWDAPP_NAME}-spicedb
    spec:
      config:
        logLevel: debug
        replicas: ${{SPICEDB_REPLICAS}}
        datastoreEngine: postgres
      secretName: spicedb-config
      patches:
      - kind: Job
        patch:
          spec:
            template:
              spec:
                containers:
                  - name: migrate
                    volumeMounts:
                      - mountPath: /etc/tls/rds.pem
                        name: rds-tls
                        subPath: db.ca_cert
                volumes:
                  - name: rds-tls
                    secret:
                      secretName: kessel-relations-spicedb
      - kind: Deployment
        patch:
          spec:
            template:
              spec:
                containers:
                - name: spicedb
                  resources:
                    requests:
                      memory: ${SPICEDB_REQUESTS_MEMORY}
                      cpu: ${SPICEDB_REQUESTS_CPU}
                    limits:
                      memory: ${SPICEDB_LIMITS_MEMORY}
                      cpu: ${SPICEDB_LIMITS_CPU}
                  env:
                    - name: SPICEDB_DATASTORE_REVISION_QUANTIZATION_INTERVAL
                      value: ${SPICEDB_QUANTIZATION_INTERVAL}
                    - name: SPICEDB_DATASTORE_REVISION_QUANTIZATION_MAX_STALENESS_PERCENT
                      value: ${SPICEDB_QUANTIZATION_STALENESS_PERCENT}
                    - name: SPICEDB_DATASTORE_CONN_POOL_READ_MAX_OPEN
                      value: ${SPICEDB_DATASTORE_MAX_CONN_OPEN}
                    - name: SPICEDB_DATASTORE_CONN_POOL_READ_MIN_OPEN
                      value: ${SPICEDB_DATASTORE_MIN_CONN_OPEN}
                    - name: SPICEDB_ENABLE_EXPERIMENTAL_WATCHABLE_SCHEMA_CACHE
                      value: ${SPICEDB_ENABLE_WATCHABLE_SCHEMA_CACHE}
                  volumeMounts:
                    - name: rds-tls
                      mountPath: /etc/tls/rds.pem
                      subPath: db.ca_cert
                volumes:
                  - name: rds-tls
                    secret:
                      secretName: kessel-relations-spicedb
  - apiVersion: cloud.redhat.com/v1alpha1
    kind: ClowdApp
    metadata:
      name: ${CLOWDAPP_NAME}
    spec:
      envName: ${ENV_NAME}
      testing:
        iqePlugin: relations_api
      deployments:
        - name: api
          minReplicas: ${{RELATIONS_REPLICAS}}
          podSpec:
            image: ${RELATIONS_IMAGE}:${IMAGE_TAG}
            livenessProbe:
              httpGet:
                path: /api/authz/livez
                port: 8000
            readinessProbe:
              httpGet:
                path: /api/authz/readyz
                port: 8000
            resources:
              requests:
                memory: ${RELATIONS_REQUESTS_MEMORY}
                cpu: ${RELATIONS_REQUESTS_CPU}
              limits:
                memory: ${RELATIONS_LIMITS_MEMORY}
                cpu: ${RELATIONS_LIMITS_CPU}
            env:
              - name: SPICEDB_PRESHARED
                valueFrom:
                  secretKeyRef:
                    key: preshared_key
                    name: spicedb-config
              - name: SPICEDB_ENDPOINT
                value: ${CLOWDAPP_NAME}-spicedb:50051
              - name: SPICEDB_SCHEMA_FILE
                value: /etc/schema/schema.zed
            volumes:
            - name: schema
              configMap:
                name: spicedb-schema
            - name: relations-api-config
              configMap:
                name: relations-api-config
            volumeMounts:
              - name: schema
                mountPath: /etc/schema
              - name: relations-api-config
                mountPath: /config
          webServices:
            public:
              enabled: true
              apiPath: authz
  - kind: PodDisruptionBudget
    apiVersion: policy/v1
    metadata:
      name: kessel-relations-api-pdb
    spec:
      minAvailable: 1
      selector:
        matchLabels:
          app: kessel-relations
  - kind: PodDisruptionBudget
    apiVersion: policy/v1
    metadata:
      name: kessel-spicedb-pdb
    spec:
      minAvailable: 1
      selector:
        matchLabels:
          app.kubernetes.io/instance: kessel-relations-spicedb-spicedb
parameters:
  - description: Name of the ClowdApp
    name: CLOWDAPP_NAME
    value: kessel-relations
  - description: ClowdEnvironment name (ephemeral, stage, prod)
    name: ENV_NAME
    required: true
  - description: App Image
    name: RELATIONS_IMAGE
    value: quay.io/redhat-services-prod/project-kessel-tenant/kessel-relations/relations-api
  - description: Image Tag
    name: IMAGE_TAG
    required: true
    value: latest
  - description: Number of pods for spiceDB service
    name: SPICEDB_REPLICAS
    value: '1'
  - description: Number of pods for relations service
    name: RELATIONS_REPLICAS
    value: '1'
  - description: Memory request for SpiceDB
    name: SPICEDB_REQUESTS_MEMORY
    value: '128Mi'
  - description: CPU request for SpiceDB
    name: SPICEDB_REQUESTS_CPU
    value: '25m'
  - description: Memory limit for SpiceDB
    name: SPICEDB_LIMITS_MEMORY
    value: '256Mi'
  - description: CPU limit for SpiceDB
    name: SPICEDB_LIMITS_CPU
    value: '100m'
  - description: Memory request for relations service
    name: RELATIONS_REQUESTS_MEMORY
    value: '512Mi'
  - description: CPU request for relations service
    name: RELATIONS_REQUESTS_CPU
    value: '150m'
  - description: Memory limit for relations service
    name: RELATIONS_LIMITS_MEMORY
    value: '1Gi'
  - description: CPU limit for relations service
    name: RELATIONS_LIMITS_CPU
    value: '300m'
  - description: SpiceDB quantization interval in seconds
    name: SPICEDB_QUANTIZATION_INTERVAL
    value: '5s'
  - description: SpiceDB quantization max staleness percent (float)
    name: SPICEDB_QUANTIZATION_STALENESS_PERCENT
    value: '0.1'
  - description: Maximum number of open connections to datastore
    name: SPICEDB_DATASTORE_MAX_CONN_OPEN
    value: '20'
  - description: Minimum number of open connections to datastore
    name: SPICEDB_DATASTORE_MIN_CONN_OPEN
    value: '20'
  - description: Enable the experimental schema cache which makes use of the Watch API for automatic updates
    name: SPICEDB_ENABLE_WATCHABLE_SCHEMA_CACHE
    value: 'false'