apiVersion: v1
kind: ServiceAccount
metadata:
  name: dataops-hook-bootstrap
  namespace: {{ .Values.namespace }}
  annotations:
    helm.sh/hook: pre-install,pre-upgrade
    helm.sh/hook-weight: "-40"
    helm.sh/hook-delete-policy: before-hook-creation
automountServiceAccountToken: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: dataops-hook-bootstrap
  namespace: {{ .Values.namespace }}
  annotations:
    helm.sh/hook: pre-install,pre-upgrade
    helm.sh/hook-weight: "-39"
    helm.sh/hook-delete-policy: before-hook-creation
rules: []
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: dataops-hook-bootstrap
  namespace: {{ .Values.namespace }}
  annotations:
    helm.sh/hook: pre-install,pre-upgrade
    helm.sh/hook-weight: "-38"
    helm.sh/hook-delete-policy: before-hook-creation
subjects:
- kind: ServiceAccount
  name: dataops-hook-bootstrap
  namespace: {{ .Values.namespace }}
roleRef: {apiGroup: rbac.authorization.k8s.io, kind: Role, name: dataops-hook-bootstrap}
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: dataops-backend
  namespace: {{ .Values.namespace }}
spec: {minAvailable: 1, selector: {matchLabels: {app: dataops-backend}}}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: dataops-default-deny
  namespace: {{ .Values.namespace }}
spec: {podSelector: {}, policyTypes: [Ingress, Egress]}
---
apiVersion: batch/v1
kind: Job
metadata:
  name: dataops-role-init
  namespace: {{ .Values.namespace }}
  labels: {app: dataops-role-init}
  annotations:
    helm.sh/hook: pre-install,pre-upgrade
    helm.sh/hook-weight: "-20"
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
spec:
  template:
    metadata: {labels: {app: dataops-role-init}}
    spec:
      serviceAccountName: dataops-hook-bootstrap
      automountServiceAccountToken: false
      restartPolicy: Never
      securityContext: {seccompProfile: {type: RuntimeDefault}}
      containers:
      - name: role-init
        image: "{{ .Values.images.migrator }}"
        securityContext: {runAsNonRoot: true, allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: {drop: ["ALL"]}}
        env: [{name: DB_ROLE_INIT_DATABASE_URL, valueFrom: {secretKeyRef: {name: "{{ .Values.secrets.database }}", key: migration_url}}}]
---
apiVersion: batch/v1
kind: Job
metadata:
  name: dataops-db-migrate
  namespace: {{ .Values.namespace }}
  labels: {app: dataops-db-migrate}
  annotations:
    helm.sh/hook: pre-install,pre-upgrade
    helm.sh/hook-weight: "-10"
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
spec:
  template:
    metadata: {labels: {app: dataops-db-migrate}}
    spec:
      serviceAccountName: dataops-hook-bootstrap
      automountServiceAccountToken: false
      restartPolicy: Never
      securityContext: {seccompProfile: {type: RuntimeDefault}}
      containers:
      - name: db-migrate
        image: "{{ .Values.images.migrator }}"
        securityContext: {runAsNonRoot: true, allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: {drop: ["ALL"]}}
        env: [{name: MIGRATION_DATABASE_URL, valueFrom: {secretKeyRef: {name: "{{ .Values.secrets.database }}", key: migration_url}}}]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: dataops-hook-egress
  namespace: {{ .Values.namespace }}
  annotations:
    helm.sh/hook: pre-install,pre-upgrade
    helm.sh/hook-weight: "-30"
    helm.sh/hook-delete-policy: before-hook-creation
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values: [dataops-role-init, dataops-db-migrate]
  policyTypes: [Egress]
  egress:
  - to:
    - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}
      podSelector: {matchLabels: {k8s-app: kube-dns}}
    ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
  - to:
    - podSelector: {matchLabels: {app: dataops-postgres}}
    ports: [{protocol: TCP, port: 5432}]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: dataops-runtime-egress
  namespace: {{ .Values.namespace }}
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values: [dataops-backend, dataops-runner]
  policyTypes: [Egress]
  egress:
  - to:
    - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}
      podSelector: {matchLabels: {k8s-app: kube-dns}}
    ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
  - to:
    - podSelector: {matchLabels: {app: dataops-postgres}}
    ports: [{protocol: TCP, port: 5432}]
  - to:
    - podSelector: {matchLabels: {app: dataops-neo4j}}
    ports: [{protocol: TCP, port: 7687}]
  - to:
    - podSelector: {matchLabels: {app: dataops-minio}}
    ports: [{protocol: TCP, port: 9000}]
  - to:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values: [dataops-backend, dataops-runner]
    ports: [{protocol: TCP, port: 5500}, {protocol: TCP, port: 5600}]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: dataops-backend-ingress
  namespace: {{ .Values.namespace }}
spec:
  podSelector: {matchLabels: {app: dataops-backend}}
  policyTypes: [Ingress]
  ingress:
  - from:
    - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: dataops-ingress}}
      podSelector: {matchLabels: {app: dataops-ingress-controller}}
    ports: [{protocol: TCP, port: 5500}]
  - from:
    - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: dataops-monitoring}}
      podSelector: {matchLabels: {app: dataops-health-check}}
    ports: [{protocol: TCP, port: 5500}]