---
# Source: openproject/charts/memcached/templates/networkpolicy.yaml
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: openproject-memcached
  namespace: "openproject"
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: memcached
    app.kubernetes.io/version: 1.6.24
    helm.sh/chart: memcached-6.14.0
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/instance: openproject
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: memcached
      app.kubernetes.io/version: 1.6.24
      helm.sh/chart: memcached-6.14.0
  policyTypes:
    - Ingress
    - Egress
  egress:
    - {}
  ingress:
    - ports:
        - port: 11211
---
# Source: openproject/charts/memcached/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: false
metadata:
  name: openproject-memcached
  namespace: openproject
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: memcached
    app.kubernetes.io/version: 1.6.24
    helm.sh/chart: memcached-6.14.0
---
# Source: openproject/templates/serviceaccount.yaml
apiVersion: "v1"
kind: "ServiceAccount"
metadata:
  name: openproject
  namespace: "openproject"
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: openproject
    app.kubernetes.io/version: 17.5.1
    helm.sh/chart: openproject-13.8.1
    app.kubernetes.io/component: openproject
...
---
# Source: openproject/templates/secret_core.yaml
apiVersion: "v1"
kind: "Secret"
metadata:
  name: "openproject-core"
  namespace: "openproject"
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: openproject
    app.kubernetes.io/version: 17.5.1
    helm.sh/chart: openproject-13.8.1
    app.kubernetes.io/component: openproject
data: # reset data to make sure only keys defined below remain
stringData:
  DATABASE_HOST: "platform-postgres.platform-services.svc.cluster.local"
  DATABASE_PORT: "5432"
  DATABASE_URL: "postgresql://openproject@platform-postgres.platform-services.svc.cluster.local:5432/openproject"
  OPENPROJECT_SEED_ADMIN_USER_PASSWORD: "TempPass123"
  OPENPROJECT_SEED_ADMIN_USER_PASSWORD_RESET: "true"
  OPENPROJECT_SEED_ADMIN_USER_NAME: "IT Admin"
  OPENPROJECT_SEED_ADMIN_USER_MAIL: "it.admin@symcrest.com"
  OPENPROJECT_HTTPS: "true"
  OPENPROJECT_HOST__NAME: "www.symcrest.com"
  OPENPROJECT_HSTS: "true"
  OPENPROJECT_RAILS__CACHE__STORE: "memcache"
  OPENPROJECT_RAILS__RELATIVE__URL__ROOT: "/internal/dev/openproject"
  POSTGRES_STATEMENT_TIMEOUT: "120s"
...
---
# Source: openproject/templates/secret_memcached.yaml
apiVersion: "v1"
kind: "Secret"
metadata:
  name: "openproject-memcached"
  namespace: "openproject"
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: openproject
    app.kubernetes.io/version: 17.5.1
    helm.sh/chart: openproject-13.8.1
    app.kubernetes.io/component: memcached
data: # reset data to make sure only keys defined below remain
stringData:
  OPENPROJECT_CACHE__MEMCACHE__SERVER: "openproject-memcached:11211"
...
---
# Source: openproject/templates/secret_secret_key_base.yaml
apiVersion: "v1"
kind: "Secret"
metadata:
  name: secret-key-base-auto-generated
  namespace: "openproject"
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: openproject
    app.kubernetes.io/version: 17.5.1
    helm.sh/chart: openproject-13.8.1
    app.kubernetes.io/component: openproject
  annotations:
    # This annotation together with the lookup of the existing secret above ensures that this secret is not
    # regenerated during each upgrade, but kept the same.
    "helm.sh/resource-policy": "keep"
data: # reset data to make sure only keys defined below remain
stringData:
  secret-key-base: SDuOoKzOjz5WqKN1MUWy3hmnXAr7xWyP8aRRiSp2CdYbKXVL2cpNPgbk8pQSWkdu
...
---
# Source: openproject/templates/persistentvolumeclaim.yaml
apiVersion: "v1"
kind: "PersistentVolumeClaim"
metadata:
  name: openproject
  namespace: "openproject"
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: openproject
    app.kubernetes.io/version: 17.5.1
    helm.sh/chart: openproject-13.8.1
    app.kubernetes.io/component: openproject
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: longhorn
  resources:
    requests:
      storage: "1Gi"
...
---
# Source: openproject/charts/memcached/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: openproject-memcached
  namespace: openproject
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: memcached
    app.kubernetes.io/version: 1.6.24
    helm.sh/chart: memcached-6.14.0
spec:
  type: ClusterIP
  ports:
    - name: memcache
      port: 11211
      targetPort: memcache
      nodePort: null
  selector:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/name: memcached
---
# Source: openproject/templates/service.yaml
apiVersion: "v1"
kind: "Service"
metadata:
  name: openproject
  namespace: "openproject"
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: openproject
    app.kubernetes.io/version: 17.5.1
    helm.sh/chart: openproject-13.8.1
    app.kubernetes.io/component: openproject
spec:
  type: ClusterIP
  ports:
    - port: 8080
      targetPort: http
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: openproject
    app.kubernetes.io/instance: openproject
    openproject/process: web
...
---
# Source: openproject/charts/memcached/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openproject-memcached
  namespace: openproject
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: memcached
    app.kubernetes.io/version: 1.6.24
    helm.sh/chart: memcached-6.14.0
spec:
  selector:
    matchLabels:
      app.kubernetes.io/instance: openproject
      app.kubernetes.io/name: memcached
  replicas: 1
  strategy:
    rollingUpdate: {}
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: openproject
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: memcached
        app.kubernetes.io/version: 1.6.24
        helm.sh/chart: memcached-6.14.0
      annotations:
    spec:
      
      automountServiceAccountToken: false
      affinity:
        podAffinity:
          
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/instance: openproject
                    app.kubernetes.io/name: memcached
                topologyKey: kubernetes.io/hostname
              weight: 1
        nodeAffinity:
          
      securityContext:
        fsGroup: 1001
        fsGroupChangePolicy: Always
        supplementalGroups: []
        sysctls: []
      serviceAccountName: openproject-memcached
      containers:
        - name: memcached
          image: docker.io/bitnamilegacy/memcached:1.6.24-debian-12-r0
          imagePullPolicy: "IfNotPresent"
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: false
            runAsGroup: 1001
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: null
            seccompProfile:
              type: RuntimeDefault
          env:
            - name: BITNAMI_DEBUG
              value: "false"
            - name: MEMCACHED_PORT_NUMBER
              value: "11211"
          ports:
            - name: memcache
              containerPort: 11211
          livenessProbe:
            failureThreshold: 6
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
            tcpSocket:
              port: memcache
          readinessProbe:
            failureThreshold: 6
            initialDelaySeconds: 5
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 3
            tcpSocket:
              port: memcache
          volumeMounts:
            - name: empty-dir
              mountPath: /opt/bitnami/memcached/conf
              subPath: app-conf-dir
            - name: empty-dir
              mountPath: /tmp
              subPath: tmp-dir
      volumes:
        - name: empty-dir
          emptyDir: {}
---
# Source: openproject/templates/cron-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openproject-cron
  namespace: "openproject"
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: openproject
    app.kubernetes.io/version: 17.5.1
    helm.sh/chart: openproject-13.8.1
    openproject/process: cron
    app.kubernetes.io/component: cron
spec:
  replicas: 0
  strategy:
    type: "Recreate"
  selector:
    matchLabels:
      app.kubernetes.io/name: openproject
      app.kubernetes.io/instance: openproject
      openproject/process: cron
  template:
    metadata:
      annotations:
        
        # annotate pods with env value checksums so changes trigger re-deployments
        
        checksum/env-core: 9168cde503dc9ab26d56a3d92b2f12e3634fcc94d89a489f1fe35418b66c6357
        checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d
        checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
        checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
        checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
        checksum/env-cron-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
      labels:
        app.kubernetes.io/instance: openproject
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: openproject
        app.kubernetes.io/version: 17.5.1
        helm.sh/chart: openproject-13.8.1
        openproject/process: cron
        app.kubernetes.io/component: cron
    spec:      
      nodeSelector:
        workload: app      
      securityContext:
        fsGroup: 1000
      serviceAccountName: openproject
      volumes:        
        - name: tmp
          # we can't use emptyDir due to the sticky bit issue
          # see: https://github.com/kubernetes/kubernetes/issues/110835
          ephemeral:
            volumeClaimTemplate:
              metadata:
                creationTimestamp: null
              spec:
                accessModes: ["ReadWriteOnce"]
                storageClassName: longhorn
                resources:
                  requests:
                    storage: 5Gi
        - name: app-tmp
          # we can't use emptyDir due to the sticky bit / world writable issue
          # see: https://github.com/kubernetes/kubernetes/issues/110835
          ephemeral:
            volumeClaimTemplate:
              metadata:
                creationTimestamp: null
              spec:
                accessModes: ["ReadWriteOnce"]
                storageClassName: longhorn
                resources:
                  requests:
                    storage: 5Gi
        - name: "data"
          persistentVolumeClaim:
            claimName: openproject        
      initContainers:        
        - name: prepare-tmpdir  
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          image: docker.io/openproject/openproject:17.5.1-slim
          imagePullPolicy: Always
          command:
            - sh
            - -c
            - mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
          resources:
            limits:
              memory: 1024Mi
            requests:
              memory: 512Mi
          volumeMounts:    
            - mountPath: /tmp
              name: tmp
            - mountPath: /app/tmp
              name: app-tmp
        - name: wait-for-db          
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          image: docker.io/openproject/openproject:17.5.1-slim
          imagePullPolicy: Always
          envFrom:
            - secretRef:
                name: openproject-core
            - secretRef:
                name: openproject-memcached
            - secretRef:
                name: openproject-postgres-secret
            - secretRef:
                name: openproject-cron-environment
          env:
            
            - name: TMPDIR
              value: /tmp/ruby
            - name: OPENPROJECT_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-postgres-secret
                  key: password
            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
                  name: secret-key-base-auto-generated
                  key: secret-key-base
          args:
            - bash
            - /app/docker/prod/wait-for-db
          resources:
            limits:
              memory: 1024Mi
            requests:
              memory: 512Mi
          volumeMounts:            
            - mountPath: /tmp
              name: tmp
            - mountPath: /app/tmp
              name: app-tmp
      containers:
        - name: "cron"          
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          image: docker.io/openproject/openproject:17.5.1-slim
          imagePullPolicy: Always
          envFrom:
            - secretRef:
                name: openproject-core
            - secretRef:
                name: openproject-memcached
            - secretRef:
                name: openproject-postgres-secret
            - secretRef:
                name: openproject-cron-environment
          args:
            - bash
            - /app/docker/prod/cron
          env:
            
            - name: TMPDIR
              value: /tmp/ruby
            - name: OPENPROJECT_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-postgres-secret
                  key: password
            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
                  name: secret-key-base-auto-generated
                  key: secret-key-base
          volumeMounts:            
            - mountPath: /tmp
              name: tmp
            - mountPath: /app/tmp
              name: app-tmp
            - name: "data"
              mountPath: "/var/openproject/assets"            
          resources:
            limits:
              cpu: "1"
              memory: 1Gi
            requests:
              cpu: 250m
              memory: 256Mi
---
# Source: openproject/templates/web-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openproject-web
  namespace: "openproject"
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: openproject
    app.kubernetes.io/version: 17.5.1
    helm.sh/chart: openproject-13.8.1
    openproject/process: web
    app.kubernetes.io/component: web
spec:
  replicas: 1
  strategy:
    
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: openproject
      app.kubernetes.io/instance: openproject
      openproject/process: web
  template:
    metadata:
      annotations:
        
        # annotate pods with env value checksums so changes trigger re-deployments
        
        checksum/env-core: 9168cde503dc9ab26d56a3d92b2f12e3634fcc94d89a489f1fe35418b66c6357
        checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d
        checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
        checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
        checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
      labels:
        app.kubernetes.io/instance: openproject
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: openproject
        app.kubernetes.io/version: 17.5.1
        helm.sh/chart: openproject-13.8.1
        openproject/process: web
        app.kubernetes.io/component: web
    spec:      
      nodeSelector:
        workload: app      
      securityContext:
        fsGroup: 1000
      serviceAccountName: openproject
      volumes:        
        - name: tmp
          # we can't use emptyDir due to the sticky bit issue
          # see: https://github.com/kubernetes/kubernetes/issues/110835
          ephemeral:
            volumeClaimTemplate:
              metadata:
                creationTimestamp: null
              spec:
                accessModes: ["ReadWriteOnce"]
                storageClassName: longhorn
                resources:
                  requests:
                    storage: 5Gi
        - name: app-tmp
          # we can't use emptyDir due to the sticky bit / world writable issue
          # see: https://github.com/kubernetes/kubernetes/issues/110835
          ephemeral:
            volumeClaimTemplate:
              metadata:
                creationTimestamp: null
              spec:
                accessModes: ["ReadWriteOnce"]
                storageClassName: longhorn
                resources:
                  requests:
                    storage: 5Gi
        - name: "data"
          persistentVolumeClaim:
            claimName: openproject        
      initContainers:        
        - name: prepare-tmpdir  
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          image: docker.io/openproject/openproject:17.5.1-slim
          imagePullPolicy: Always
          command:
            - sh
            - -c
            - mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
          resources:
            limits:
              memory: 1024Mi
            requests:
              memory: 512Mi
          volumeMounts:    
            - mountPath: /tmp
              name: tmp
            - mountPath: /app/tmp
              name: app-tmp
        - name: wait-for-db          
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          image: docker.io/openproject/openproject:17.5.1-slim
          imagePullPolicy: Always
          envFrom:
            - secretRef:
                name: openproject-core
            - secretRef:
                name: openproject-memcached
            - secretRef:
                name: openproject-postgres-secret
          env:
            
            - name: TMPDIR
              value: /tmp/ruby
            - name: OPENPROJECT_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-postgres-secret
                  key: password
            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
                  name: secret-key-base-auto-generated
                  key: secret-key-base
          args:
            - /app/docker/prod/wait-for-db
          resources:
            limits:
              memory: 1024Mi
            requests:
              memory: 512Mi
          volumeMounts:            
            - mountPath: /tmp
              name: tmp
            - mountPath: /app/tmp
              name: app-tmp
      containers:
        - name: "openproject"          
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          image: docker.io/openproject/openproject:17.5.1-slim
          imagePullPolicy: Always
          envFrom:
            - secretRef:
                name: openproject-core
            - secretRef:
                name: openproject-memcached
            - secretRef:
                name: openproject-postgres-secret
          env:
            
            - name: TMPDIR
              value: /tmp/ruby
            - name: OPENPROJECT_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-postgres-secret
                  key: password
            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
                  name: secret-key-base-auto-generated
                  key: secret-key-base
          args:
            - /app/docker/prod/web
          volumeMounts:            
            - mountPath: /tmp
              name: tmp
            - mountPath: /app/tmp
              name: app-tmp
            - name: "data"
              mountPath: "/var/openproject/assets"            
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          livenessProbe:
            httpGet:
              path: "/internal/dev/openproject/health_checks/default"
              port: 8080
              httpHeaders:
                # required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants
                - name: Host
                  value: localhost
            initialDelaySeconds: 0
            timeoutSeconds: 5
            periodSeconds: 15
            failureThreshold: 3
            successThreshold: 1
          readinessProbe:
            httpGet:
              path: "/internal/dev/openproject/health_checks/default"
              port: 8080
              httpHeaders:
                # required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants
                - name: Host
                  value: localhost
            initialDelaySeconds: 0
            timeoutSeconds: 5
            periodSeconds: 10
            failureThreshold: 3
            successThreshold: 1
          startupProbe:
            httpGet:
              path: "/internal/dev/openproject/health_checks/default"
              port: 8080
              httpHeaders:
                # required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants
                - name: Host
                  value: localhost
            initialDelaySeconds: 60
            timeoutSeconds: 5
            periodSeconds: 15
            failureThreshold: 10
            successThreshold: 1
          resources:
            limits:
              cpu: "4"
              memory: 4Gi
            requests:
              cpu: 250m
              memory: 512Mi
---
# Source: openproject/templates/worker-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openproject-worker-default
  namespace: "openproject"
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: openproject
    app.kubernetes.io/version: 17.5.1
    helm.sh/chart: openproject-13.8.1
    openproject/process: worker-default
    app.kubernetes.io/component: worker-default
spec:
  replicas: 1
  strategy:
    
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: openproject
      app.kubernetes.io/instance: openproject
      openproject/process: worker-default
  template:
    metadata:
      annotations:
        
        # annotate pods with env value checksums so changes trigger re-deployments
        
        checksum/env-core: 9168cde503dc9ab26d56a3d92b2f12e3634fcc94d89a489f1fe35418b66c6357
        checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d
        checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
        checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
        checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
      labels:
        app.kubernetes.io/instance: openproject
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: openproject
        app.kubernetes.io/version: 17.5.1
        helm.sh/chart: openproject-13.8.1
        openproject/process: worker-default
        app.kubernetes.io/component: worker-default
    spec:      
      nodeSelector:
        workload: app      
      securityContext:
        fsGroup: 1000
      serviceAccountName: openproject
      volumes:        
        - name: tmp
          # we can't use emptyDir due to the sticky bit issue
          # see: https://github.com/kubernetes/kubernetes/issues/110835
          ephemeral:
            volumeClaimTemplate:
              metadata:
                creationTimestamp: null
              spec:
                accessModes: ["ReadWriteOnce"]
                storageClassName: longhorn
                resources:
                  requests:
                    storage: 5Gi
        - name: app-tmp
          # we can't use emptyDir due to the sticky bit / world writable issue
          # see: https://github.com/kubernetes/kubernetes/issues/110835
          ephemeral:
            volumeClaimTemplate:
              metadata:
                creationTimestamp: null
              spec:
                accessModes: ["ReadWriteOnce"]
                storageClassName: longhorn
                resources:
                  requests:
                    storage: 5Gi
        - name: "data"
          persistentVolumeClaim:
            claimName: openproject        
      initContainers:        
        - name: prepare-tmpdir  
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          image: docker.io/openproject/openproject:17.5.1-slim
          imagePullPolicy: Always
          command:
            - sh
            - -c
            - mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
          resources:
            limits:
              memory: 1024Mi
            requests:
              memory: 512Mi
          volumeMounts:    
            - mountPath: /tmp
              name: tmp
            - mountPath: /app/tmp
              name: app-tmp
        - name: wait-for-db          
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          image: docker.io/openproject/openproject:17.5.1-slim
          imagePullPolicy: Always
          envFrom:
            - secretRef:
                name: openproject-core
            - secretRef:
                name: openproject-memcached
            - secretRef:
                name: openproject-postgres-secret
          env:
            
            - name: TMPDIR
              value: /tmp/ruby
            - name: OPENPROJECT_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-postgres-secret
                  key: password
            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
                  name: secret-key-base-auto-generated
                  key: secret-key-base
          args:
            - bash
            - /app/docker/prod/wait-for-db
          resources:
            limits:
              memory: 1024Mi
            requests:
              memory: 512Mi
          volumeMounts:            
            - mountPath: /tmp
              name: tmp
            - mountPath: /app/tmp
              name: app-tmp
      containers:
        - name: "openproject"          
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          image: docker.io/openproject/openproject:17.5.1-slim
          imagePullPolicy: Always
          envFrom:
            - secretRef:
                name: openproject-core
            - secretRef:
                name: openproject-memcached
            - secretRef:
                name: openproject-postgres-secret
          args:
            - bash
            - /app/docker/prod/worker
          env:
            
            - name: TMPDIR
              value: /tmp/ruby
            - name: OPENPROJECT_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-postgres-secret
                  key: password
            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
                  name: secret-key-base-auto-generated
                  key: secret-key-base
            - name: "OPENPROJECT_GOOD_JOB_QUEUES"
              value: ""
          volumeMounts:            
            - mountPath: /tmp
              name: tmp
            - mountPath: /app/tmp
              name: app-tmp
            - name: "data"
              mountPath: "/var/openproject/assets"            
          resources:
            limits:
              cpu: "4"
              memory: 4Gi
            requests:
              cpu: 250m
              memory: 512Mi
---
# Source: openproject/templates/seeder-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: openproject-seeder-1
  namespace: "openproject"
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: openproject
    app.kubernetes.io/version: 17.5.1
    helm.sh/chart: openproject-13.8.1
    app.kubernetes.io/component: seeder
spec:
  ttlSecondsAfterFinished: 86400
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: openproject
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: openproject
        app.kubernetes.io/version: 17.5.1
        helm.sh/chart: openproject-13.8.1
        openproject/process: seeder
        app.kubernetes.io/component: seeder
    spec:
      serviceAccountName: openproject            
      securityContext:
        fsGroup: 1000
      nodeSelector:
        workload: app
      volumes:        
        - name: tmp
          # we can't use emptyDir due to the sticky bit issue
          # see: https://github.com/kubernetes/kubernetes/issues/110835
          ephemeral:
            volumeClaimTemplate:
              metadata:
                creationTimestamp: null
              spec:
                accessModes: ["ReadWriteOnce"]
                storageClassName: longhorn
                resources:
                  requests:
                    storage: 5Gi
        - name: app-tmp
          # we can't use emptyDir due to the sticky bit / world writable issue
          # see: https://github.com/kubernetes/kubernetes/issues/110835
          ephemeral:
            volumeClaimTemplate:
              metadata:
                creationTimestamp: null
              spec:
                accessModes: ["ReadWriteOnce"]
                storageClassName: longhorn
                resources:
                  requests:
                    storage: 5Gi
        - name: "data"
          persistentVolumeClaim:
            claimName: openproject        
      initContainers:        
        - name: prepare-tmpdir  
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          image: docker.io/openproject/openproject:17.5.1-slim
          imagePullPolicy: Always
          command:
            - sh
            - -c
            - mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
          resources:
            limits:
              memory: 1024Mi
            requests:
              memory: 512Mi
          volumeMounts:    
            - mountPath: /tmp
              name: tmp
            - mountPath: /app/tmp
              name: app-tmp
        - name: check-db-ready
          image: "docker.io/postgres:16"
          imagePullPolicy: Always
          command: [
            'sh',
            '-c',
            'until pg_isready -h $DATABASE_HOST -p $DATABASE_PORT -U openproject; do echo "waiting for database $DATABASE_HOST:$DATABASE_PORT"; sleep 2; done;'
          ]
          envFrom:
            - secretRef:
                name: openproject-core
            - secretRef:
                name: openproject-memcached
            - secretRef:
                name: openproject-postgres-secret
          env:
            
            - name: TMPDIR
              value: /tmp/ruby
            - name: OPENPROJECT_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-postgres-secret
                  key: password
            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
                  name: secret-key-base-auto-generated
                  key: secret-key-base
          resources:
            limits:
              memory: 200Mi
            requests:
              memory: 200Mi
          volumeMounts:            
            - mountPath: /tmp
              name: tmp
            - mountPath: /app/tmp
              name: app-tmp          
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
      containers:
        - name: seeder
          image: "docker.io/openproject/openproject:17.5.1-slim"
          imagePullPolicy: Always
          args:
            - bash
            - /app/docker/prod/seeder
          envFrom:
            - secretRef:
                name: openproject-core
            - secretRef:
                name: openproject-memcached
            - secretRef:
                name: openproject-postgres-secret
          env:
            
            - name: TMPDIR
              value: /tmp/ruby
            - name: OPENPROJECT_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-postgres-secret
                  key: password
            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
                  name: secret-key-base-auto-generated
                  key: secret-key-base
          resources:
            limits:
              memory: 1Gi
            requests:
              memory: 512Mi
          volumeMounts:            
            - mountPath: /tmp
              name: tmp
            - mountPath: /app/tmp
              name: app-tmp
            - name: "data"
              mountPath: "/var/openproject/assets"                      
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
      restartPolicy: OnFailure
---
# Source: openproject/templates/secret_hocuspocus.yaml
# Only generate this secret if
#   a) the included hocuspocus deployment is enabled
#   b) no existing secret is configured for the openproject realtime collaboration
#   c) no existing secret is configured for the included hocuspocus deployment
# and if
#   d) this automatically generated secret does not exist yet.
---
# Source: openproject/templates/secret_secret_key_base.yaml
# Only generate this secret if
#   a) no existing secret is configured for SECRET_KEY_BASE
# and if
#   b) SECRET_KEY_BASE is not provided via the environment values
# and if
#   c) this automatically generated secret does not exist yet.
---
# Source: openproject/templates/tests/test-connection.yaml
apiVersion: "v1"
kind: "Pod"
metadata:
  name: "openproject-test-connection"
  namespace: "openproject"
  labels:
    app.kubernetes.io/instance: openproject
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: openproject
    app.kubernetes.io/version: 17.5.1
    helm.sh/chart: openproject-13.8.1
    app.kubernetes.io/component: test-connection
  annotations:
    "helm.sh/hook": test
spec:
  serviceAccountName: openproject
  containers:
    - name: "wget"
      image: "busybox"
      imagePullPolicy: Always
      command: ['wget']
      args:
        - '--no-verbose'
        - '--tries=1'
        - '--spider'
        - 'openproject:8080/health_check'
  restartPolicy: "Never"
...