apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  serviceName: postgres
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      serviceAccountName: postgres
      securityContext:
        fsGroup: 999
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: postgres
          image: postgres:16-alpine
          ports:
            - containerPort: 5432
              name: postgres
          env:
            - name: PGDATA
              value: /var/lib/postgresql/data/pgdata
            - name: POSTGRES_USER
              valueFrom:
                configMapKeyRef:
                  name: platform-config
                  key: POSTGRES_SUPERUSER
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-superuser-credentials
                  key: POSTGRES_SUPERUSER_PASSWORD
            - name: POSTGRES_DB
              valueFrom:
                configMapKeyRef:
                  name: platform-config
                  key: POSTGRES_DEFAULT_DB
            - name: AUTH_DB_NAME
              valueFrom:
                configMapKeyRef:
                  name: platform-config
                  key: AUTH_DB_NAME
            - name: AUTH_DB_USER
              valueFrom:
                configMapKeyRef:
                  name: platform-config
                  key: AUTH_DB_USER
            - name: AUTH_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-auth-server-credentials
                  key: AUTH_DB_PASSWORD
            - name: KEYCLOAK_DB_NAME
              valueFrom:
                configMapKeyRef:
                  name: platform-config
                  key: KEYCLOAK_DB_NAME
            - name: KEYCLOAK_DB_USER
              valueFrom:
                configMapKeyRef:
                  name: platform-config
                  key: KEYCLOAK_DB_USER
            - name: KEYCLOAK_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-keycloak-credentials
                  key: KEYCLOAK_DB_PASSWORD
          securityContext:
          volumeMounts:
            - name: postgres-data
              mountPath: /var/lib/postgresql/data
            - name: postgres-init-script
              mountPath: /docker-entrypoint-initdb.d/01-init-project-auth-databases.sh
              subPath: 01-init-project-auth-databases.sh
            - name: postgres-run
              mountPath: /var/run/postgresql
          readinessProbe:
            exec:
              command:
                - sh
                - -c
                - pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 3
          livenessProbe:
            exec:
              command:
                - sh
                - -c
                - pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"
            initialDelaySeconds: 20
            periodSeconds: 15
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 250m
              memory: 512Mi
            limits:
              cpu: 1000m
              memory: 1024Mi
      volumes:
        - name: postgres-init-script
          configMap:
            name: postgres-init-script
            defaultMode: 0555
        - name: postgres-run
          emptyDir: {}
  volumeClaimTemplates:
    - metadata:
        name: postgres-data
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 5Gi