# Copyright (C) 2019, Wazuh Inc.
#
# This program is a free software; you can redistribute it
# and/or modify it under the terms of the GNU General Public
# License (version 2) as published by the FSF - Free Software
# Foundation.

# Wazuh workers StatefulSet

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: wazuh-manager-worker
  namespace: wazuh
spec:
  replicas: 2
  selector:
    matchLabels:
      app: wazuh-manager
      node-type: worker
  serviceName: wazuh-cluster
  podManagementPolicy: Parallel
  template:
    metadata:
      labels:
        app: wazuh-manager
        node-type: worker
      name: wazuh-manager-worker
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                topologyKey: kubernetes.io/hostname
                labelSelector:
                  matchLabels:
                    app: wazuh-manager
                    node-type: worker
      volumes:
        - name: wazuh-server-certs
          secret:
            secretName: indexer-certs
      initContainers:
        - name: init-wazuh-etc
          image: 'wazuh/wazuh-manager:5.0.0'
          command:
            - /bin/sh
            - -c
            - |
              if [ -z "$(ls -A /pvc-etc)" ]; then
                cp -a /var/ossec/etc/* /pvc-etc/
              fi
          volumeMounts:
            - name: wazuh-manager-worker
              mountPath: /pvc-etc
              subPath: wazuh/var/ossec/etc
      securityContext:
        fsGroup: 101
      containers:
        - name: wazuh-manager
          image: 'wazuh/wazuh-manager:5.0.0'
          resources:
            limits:
              cpu: 400m
              memory: 512Mi
          securityContext:
            capabilities:
              add: ["SYS_CHROOT"]
          volumeMounts:
            - name: wazuh-manager-worker
              mountPath: /var/ossec/api/configuration
              subPath: wazuh/var/ossec/api/configuration
            - name: wazuh-manager-worker
              mountPath: /var/ossec/etc
              subPath: wazuh/var/ossec/etc
            - name: wazuh-server-certs
              mountPath: /var/ossec/etc/certs/root-ca.pem
              readOnly: true
              subPath: root-ca.pem
            - name: wazuh-server-certs
              mountPath: /var/ossec/etc/certs/server.pem
              subPath: server.pem
              readOnly: true
            - name: wazuh-server-certs
              mountPath: /var/ossec/etc/certs/server-key.pem
              subPath: server-key.pem
              readOnly: true
            - name: wazuh-manager-worker
              mountPath: /var/ossec/logs
              subPath: wazuh/var/ossec/logs
            - name: wazuh-manager-worker
              mountPath: /var/ossec/queue
              subPath: wazuh/var/ossec/queue
            - name: wazuh-manager-worker
              mountPath: /var/ossec/var/multigroups
              subPath: wazuh/var/ossec/var/multigroups
            - name: wazuh-manager-worker
              mountPath: /var/ossec/active-response/bin
              subPath: wazuh/var/ossec/active-response/bin
            - name: wazuh-manager-worker
              mountPath: /var/ossec/wodles
              subPath: wazuh/var/ossec/wodles
          ports:
            - containerPort: 1514
              name: agents-events
            - containerPort: 1516
              name: cluster
          env:
            - name: WAZUH_INDEXER_HOSTS
              value: 'wazuh-indexer:9200'
            - name: WAZUH_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: WAZUH_NODE_TYPE
              value: 'worker'
            - name: WAZUH_CLUSTER_BIND_ADDR
              value: '0.0.0.0'
            - name: WAZUH_CLUSTER_NODES
              value: 'wazuh-cluster'
            - name: INDEXER_USERNAME
              valueFrom:
                secretKeyRef:
                  name: indexer-cred
                  key: username
            - name: INDEXER_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: indexer-cred
                  key: password
            - name: SSL_CERTIFICATE_AUTHORITIES
              value: /var/ossec/etc/certs/root-ca.pem
            - name: SSL_CERTIFICATE
              value: /var/ossec/etc/certs/server.pem
            - name: SSL_KEY
              value: /var/ossec/etc/certs/server-key.pem
            - name: WAZUH_CLUSTER_KEY
              valueFrom:
                secretKeyRef:
                  name: wazuh-cluster-key
                  key: key
  volumeClaimTemplates:
    - metadata:
        name: wazuh-manager-worker
        namespace: wazuh
      spec:
        accessModes:
          - ReadWriteOnce
        storageClassName: wazuh-storage
        resources:
          requests:
            storage: 500Mi
