{{- if semverCompare ">=1.16-0" .Capabilities.KubeVersion.GitVersion }}
apiVersion: apps/v1
{{- else }}
apiVersion: apps/v1beta1
{{- end }}
kind: StatefulSet
metadata:
  namespace: imxc
  name: elasticsearch 
spec:
{{- if semverCompare ">=1.16-0" .Capabilities.KubeVersion.GitVersion }}
  selector:
    matchLabels:
      app: elasticsearch
{{- end }}
  serviceName: elasticsearch
  replicas: 2 #3
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      securityContext:
        fsGroup: 1000
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: "app"
                    operator: In
                    values:
                    - elasticsearch
              topologyKey: "kubernetes.io/hostname"
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            preference:
              matchExpressions:
              - key: elastic-node
                operator: In
                values:
                - "true"
      initContainers:
      - name: init-sysctl
        image: {{ .Values.global.IMXC_IN_REGISTRY }}/busybox:latest
        imagePullPolicy: IfNotPresent
        securityContext:
          privileged: true
        #command: ["sysctl", "-w", "vm.max_map_count=262144"]
        command: ["/bin/sh", "-c"]
        args: ["sysctl -w vm.max_map_count=262144; chown -R 1000:1000 /usr/share/elasticsearch/data"]
        volumeMounts:
          - name: elasticsearch-data
            mountPath: /usr/share/elasticsearch/data
      containers:
      - name: elasticsearch
        resources:
          requests:
            cpu: 1000m
            memory: 16000Mi #32000Mi
          limits:
            cpu: 2000m
            memory: 16000Mi #32000Mi
        securityContext:
          privileged: true
          runAsUser: 1000
          capabilities:
            add:
            - IPC_LOCK
            - SYS_RESOURCE
        image: {{ .Values.global.IMXC_IN_REGISTRY }}/elasticsearch:{{ .Values.global.ELASTICSEARCH_VERSION }}
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: ES_JAVA_OPTS
          valueFrom:
              configMapKeyRef:
                  name: elasticsearch-config
                  key: ES_JAVA_OPTS
        # log4j patch
        - name: LOG4J_FORMAT_MSG_NO_LOOKUPS
          value: "true"
        - name: ELASTIC_USERNAME
          value: {{ .Values.global.CMOA_ES_ID }}
        - name: ELASTIC_PASSWORD
          value: {{ .Values.global.CMOA_ES_PW }}
        readinessProbe:
          httpGet:
            scheme: HTTPS
            path: /_cluster/health?local=true
            port: 9200
            httpHeaders:
              - name: Authorization
                # encode base64 by elastic:elastic
                value: Basic ZWxhc3RpYzplbGFzdGlj            
          initialDelaySeconds: 5
        ports:
        - containerPort: 9200
          name: es-http
        - containerPort: 9300
          name: es-transport
        volumeMounts:
        - name: elasticsearch-data
          mountPath: /usr/share/elasticsearch/data
        - name: elasticsearch-config
          mountPath: /usr/share/elasticsearch/config/elasticsearch.yml
          subPath: elasticsearch.yml
        - name: es-cert-certificate
          mountPath: /usr/share/elasticsearch/config/elastic-certificates.p12
          subPath: elastic-certificates.p12
        - name: es-cert-ca
          mountPath: /usr/share/elasticsearch/config/elastic-stack-ca.p12
          subPath: elastic-stack-ca.p12
        - name: es-cert-http
          mountPath: /usr/share/elasticsearch/config/http.p12
          subPath: http.p12          
      volumes:
        - name: elasticsearch-config
          configMap:
            name: elasticsearch-config
            items:
              - key: elasticsearch.yml
                path: elasticsearch.yml
        - name: es-cert-certificate
          secret:
            secretName: es-cert
        - name: es-cert-ca
          secret:
            secretName: es-cert
        - name: es-cert-http
          secret:
            secretName: es-cert                
  volumeClaimTemplates:
  - metadata:
      name: elasticsearch-data
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: elasticsearch-storage
      resources:
        requests:
          storage: 10Gi
