# Copyright (C) 2019, Wazuh Inc.
#
# This program is a free software; you can redistribute it
# and/or modify it under the terms of the GNU General Public
# License (version 2) as published by the FSF - Free Software
# Foundation.

# Indexer StatefulSet: 3 master nodes.

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: wazuh-indexer
  namespace: wazuh
spec:
  replicas: 3
  selector:
    matchLabels:
      app: wazuh-indexer
  serviceName: wazuh-indexer
  template:
    metadata:
      labels:
        app: wazuh-indexer
      name: wazuh-indexer
    spec:
      securityContext:
        fsGroup: 1000
      # Set the wazuh-indexer volume permissions so the wazuh-indexer user can use it
      volumes:
        - name: indexer-certs
          secret:
            secretName: indexer-certs
            defaultMode: 0600
      initContainers:
        - name: volume-mount-hack
          image: busybox
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              cpu: 100m
              memory: 256Mi
          command:
            - sh
            - '-c'
            - 'chown -R 1000:1000 /var/lib/wazuh-indexer'
          volumeMounts:
            - name: wazuh-indexer
              mountPath: /var/lib/wazuh-indexer
        - name: increase-the-vm-max-map-count
          image: busybox
          command:
            - sysctl
            - -w
            - vm.max_map_count=262144
          securityContext:
            privileged: true
      containers:
        - name: wazuh-indexer
          image: 'wazuh/wazuh-indexer:5.0.0'
          resources:
            limits:
              cpu: 500m
              memory: 1564Mi
          env:
            - name: bootstrap.memory_lock
              value: "false"
            - name: network.host
              value: "0.0.0.0"
            - name: node.name
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: cluster.initial_cluster_manager_nodes
              value: wazuh-indexer-0
            # For a 3-node cluster, all nodes should be listed here, if another node is added, it should be included as well
            - name: discovery.seed_hosts
              value: "wazuh-indexer-0.wazuh-indexer,wazuh-indexer-1.wazuh-indexer,wazuh-indexer-2.wazuh-indexer"
            - name: node.max_local_storage_nodes
              value: "3"
            - name: plugins.security.allow_default_init_securityindex
              value: "true"
            - name: NODES_DN
              value: CN=indexer,OU=Wazuh,O=Wazuh,L=California,C=US
            - name: OPENSEARCH_JAVA_OPTS
              value: '-Xms1g -Xmx1g -Dlog4j2.formatMsgNoLookups=true'
            - name: DISCOVERY_SERVICE
              value: wazuh-indexer
            - name: KUBERNETES_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: DISABLE_INSTALL_DEMO_CONFIG
              value: 'true'
          securityContext:
            runAsUser: 1000
            runAsGroup: 1000
            capabilities:
              add: ["SYS_CHROOT"]
          volumeMounts:
            - name: wazuh-indexer
              mountPath: /var/lib/wazuh-indexer
            - name: indexer-certs
              mountPath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem
              subPath: indexer-key.pem
              readOnly: true
            - name: indexer-certs
              mountPath: /usr/share/wazuh-indexer/config/certs/indexer.pem
              subPath: indexer.pem
              readOnly: true
            - name: indexer-certs
              mountPath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
              subPath: root-ca.pem
              readOnly: true
            - name: indexer-certs
              mountPath: /usr/share/wazuh-indexer/config/certs/admin.pem
              subPath: admin.pem
              readOnly: true
            - name: indexer-certs
              mountPath: /usr/share/wazuh-indexer/config/certs/admin-key.pem
              subPath: admin-key.pem
              readOnly: true
          ports:
            - containerPort: 9200
              name: indexer-rest
            - containerPort: 9300
              name: indexer-nodes
  volumeClaimTemplates:
    - metadata:
        name: wazuh-indexer
        namespace: indexer-cluster
      spec:
        accessModes:
          - ReadWriteOnce
        storageClassName: wazuh-storage
        resources:
          requests:
            storage: 500Mi
