staging.yml.j2

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: hokusai-sandbox
spec:
  refreshInterval: "5m"
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: hokusai-sandbox
    creationPolicy: Owner
    deletionPolicy: Merge
    template:
      engineVersion: v2
      templateFrom:
      - target: Data
        {% raw %}
        literal: |
          {{ range $key, $value := . }}
          {{$key}}: {{$value | fromJson | values | first}}
          {{ end }}
        {% endraw %}
  dataFrom:
  - find:
      name:
        regexp: "kubernetes/apps/hokusai-sandbox/*"
    rewrite:
    - regexp:
        source: "kubernetes/apps/hokusai-sandbox/(.*)"
        target: "$1"

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ project_name }}-web
  namespace: default
  labels:
    app: {{ project_name }}
    component: web
    layer: application
    app.kubernetes.io/version: staging
spec:
  replicas: 1
  selector:
    matchLabels:
      app: {{ project_name }}
      component: web
      layer: application
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: {{ project_name }}
        component: web
        layer: application
        app.kubernetes.io/version: staging
      name: {{ project_name }}-web
    spec:
      containers:
      - name: {{ project_name }}-web
        envFrom:
        - configMapRef:
            name: {{ project_name }}-environment
        - secretRef:
            name: hokusai-sandbox
            optional: true
        image: {{ project_repo }}:staging
        ports:
        - name: sandbox-http
          containerPort: 8080
        readinessProbe:
          httpGet:
            port: sandbox-http
            path: /ping
            httpHeaders:
              - name: X-Forwarded-Proto
                value: https
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 5
        env:
        - name: DATADOG_AGENT_HOSTNAME
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: DD_VERSION
          valueFrom:
            fieldRef:
              fieldPath: metadata.labels['app.kubernetes.io/version']
      dnsPolicy: ClusterFirst
      dnsConfig:
        options:
        - name: ndots
          value: '1'
      tolerations:
        - key: reserved
          operator: Equal
          value: spot
          effect: NoSchedule
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: tier
                operator: In
                values:
                - foreground
                - foreground-spot
---
apiVersion: autoscaling/v2beta2
kind: HorizontalPodAutoscaler
metadata:
  name: {{ project_name }}-web
  namespace: default
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: {{ project_name }}-web
  minReplicas: 1
  maxReplicas: 2
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 1800
  metrics:
  - resource:
      name: cpu
      target:
        averageUtilization: 70
        type: Utilization
    type: Resource
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: {{ project_name }}
    component: web
    layer: application
  name: {{ project_name }}-web-internal
  namespace: default
spec:
  ports:
  - port: 8080
    protocol: TCP
    name: http
    targetPort: sandbox-http
  selector:
    app: {{ project_name }}
    layer: application
    component: web
  type: ClusterIP
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: {{ project_name }}
  annotations:
    nginx.ingress.kubernetes.io/whitelist-source-range: {{ externalIngressAllowSourceIP|join(',') }}
spec:
  ingressClassName: nginx
  rules:
  - host: {{ project_name }}-staging.artsy.net
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          serviceName: {{ project_name }}-web-internal
          servicePort: http
---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: {{ project_name }}-cron
spec:
  schedule: 23 09 * * MON
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: {{ project_name }}-cron
            image: {{ project_repo }}:staging
            imagePullPolicy: Always
            envFrom:
            - configMapRef:
                name: {{ project_name }}-environment
            args:
            - hostname
          restartPolicy: Never
          affinity:
            nodeAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
                nodeSelectorTerms:
                - matchExpressions:
                  - key: tier
                    operator: In
                    values:
                    - background