apiVersion: v1
kind: Service
metadata:
  name: application-metier-postgres
  namespace: application-metier
  labels:
    app.kubernetes.io/name: application-metier
    app.kubernetes.io/component: postgres
spec:
  ports:
    - name: postgres
      port: 5432
      targetPort: postgres
  selector:
    app.kubernetes.io/name: application-metier
    app.kubernetes.io/component: postgres
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: application-metier-postgres
  namespace: application-metier
spec:
  serviceName: application-metier-postgres
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: application-metier
      app.kubernetes.io/component: postgres
  template:
    metadata:
      labels:
        app.kubernetes.io/name: application-metier
        app.kubernetes.io/component: postgres
        app.kubernetes.io/part-of: application-metier
    spec:
      terminationGracePeriodSeconds: 60
      securityContext:
        runAsNonRoot: true
        runAsUser: 70
        runAsGroup: 70
        seccompProfile:
          type: RuntimeDefault
        fsGroup: 70
      containers:
        - name: postgres
          image: postgres:17.10-alpine
          imagePullPolicy: IfNotPresent
          ports:
            - name: postgres
              containerPort: 5432
          env:
            - name: POSTGRES_DB
              valueFrom:
                secretKeyRef:
                  name: application-metier-secrets
                  key: POSTGRES_DB
            - name: POSTGRES_USER
              valueFrom:
                secretKeyRef:
                  name: application-metier-secrets
                  key: POSTGRES_USER
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: application-metier-secrets
                  key: POSTGRES_PASSWORD
            - name: POSTGRES_INITDB_ARGS
              value: --auth-host=scram-sha-256
            - name: PGDATA
              value: /var/lib/postgresql/data/pgdata
          readinessProbe:
            exec:
              command:
                - sh
                - -ec
                - pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"
            initialDelaySeconds: 5
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 12
          livenessProbe:
            exec:
              command:
                - sh
                - -ec
                - pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 6
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 20Gi
---
apiVersion: v1
kind: Service
metadata:
  name: application-metier-redis
  namespace: application-metier
  labels:
    app.kubernetes.io/name: application-metier
    app.kubernetes.io/component: redis
spec:
  ports:
    - name: redis
      port: 6379
      targetPort: redis
  selector:
    app.kubernetes.io/name: application-metier
    app.kubernetes.io/component: redis
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: application-metier-redis
  namespace: application-metier
spec:
  serviceName: application-metier-redis
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: application-metier
      app.kubernetes.io/component: redis
  template:
    metadata:
      labels:
        app.kubernetes.io/name: application-metier
        app.kubernetes.io/component: redis
        app.kubernetes.io/part-of: application-metier
    spec:
      terminationGracePeriodSeconds: 30
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: redis
          image: redis:7.4.9-alpine
          imagePullPolicy: IfNotPresent
          command: ["sh", "-ec"]
          args:
            - exec redis-server --appendonly yes --requirepass "$REDIS_PASSWORD"
          ports:
            - name: redis
              containerPort: 6379
          env:
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: application-metier-secrets
                  key: REDIS_PASSWORD
          readinessProbe:
            exec:
              command:
                - sh
                - -ec
                - redis-cli -a "$REDIS_PASSWORD" ping | grep -q PONG
            initialDelaySeconds: 3
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 12
          livenessProbe:
            exec:
              command:
                - sh
                - -ec
                - redis-cli -a "$REDIS_PASSWORD" ping | grep -q PONG
            initialDelaySeconds: 20
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 6
          resources:
            requests:
              cpu: 25m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: data
              mountPath: /data
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 2Gi