values.yaml

enabled: true

image:
  registry: docker.io
  repository: mojaloop/auth-service
  tag: v15.0.0
  ## Specify a imagePullPolicy
  ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
  ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
  ##
  pullPolicy: IfNotPresent
  ## Optionally specify an array of imagePullSecrets.
  ## Secrets must be manually created in the namespace.
  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  ## e.g:
  ## pullSecrets:
  ##   - myRegistryKeySecretName
  ##
  pullSecrets: []

replicaCount: 1
command: '["node", "./dist/src/cli.js", "all"]'

## Enable diagnostic mode in the deployment
##
diagnosticMode:
  ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)
  ##
  enabled: false
  ## @param diagnosticMode.command Command to override all containers in the deployment
  ##
  command: 
    - node
    - ./dist/src/cli.js
    - all
  ## @param diagnosticMode.args Args to override all containers in the deployment
  ##
  args:
    - --inspect=0.0.0.0:{{ .Values.diagnosticMode.debug.port }}
  
  ## @param diagnosticMode.debug config to override all debug information
  ##
  debug:
    internalPort: 9229
    port: 9229

readinessProbe:
  enabled: true
  httpGet:
    path: /health
  initialDelaySeconds: 60
  periodSeconds: 15

livenessProbe:
  enabled: true
  httpGet:
    path: /health
  initialDelaySeconds: 60
  periodSeconds: 15

## Pod scheduling preferences.
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
affinity: {}

## Node labels for pod assignment
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
nodeSelector: {}

## Set toleration for scheduler
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
tolerations: []

## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param containerSecurityContext.enabled Enabled %%MAIN_CONTAINER_NAME%% containers' Security Context
## @param containerSecurityContext.runAsUser Set %%MAIN_CONTAINER_NAME%% containers' Security Context runAsUser
##
containerSecurityContext:
  enabled: true
  runAsUser: 1001

# Add extra environment variables here
env:
  - name: NODE_ENV
    value: production
  # e.g. to change the Log Level:
  # - name: LOG_LEVEL
  #   value: debug

## Svc configs
config:
  ## DB Configuration
  db_host: mysqldb
  db_port: 3306
  db_user: auth_svc
  ## Secret-Management
  ### Set this if you are using a clear password configured in the config section
  db_password: ''
  ### Configure this if you want to use a secret. Note, this will override the db_password,
  ### Use the next line if you do wish to use the db_password value instead.
  # db_secret:
  ### Example config for an existing secret
  # db_secret:
  #   name: mysqldb
  #   key: mysql-password
  db_database: auth_svc

  ## Redis Configuration
  redis_host: 6379
  redis_port: auth-svc-redis-svc

## Svc config files
config_files:
  production.json: | 
    {
      "PORT": {{ .Values.service.internalPort }},
      "HOST": "0.0.0.0",
      "PARTICIPANT_ID": "centralauth",
      "REDIS": {
        "PORT": {{ .Values.config.redis_port }},
        "HOST": "{{ .Values.config.redis_host }}",
        "TIMEOUT": 100
      },
      "INSPECT": {
        "DEPTH": 4,
        "SHOW_HIDDEN": false,
        "COLOR": true
      },
      "SHARED": {
        "THIRDPARTY_REQUESTS_ENDPOINT": "{{ .Release.Name }}-tp-api-svc",
        "ALS_ENDPOINT": "{{ .Release.Name }}-account-lookup-service",
        "JWS_SIGN": false,
        "JWS_SIGNING_KEY": "/secrets/jwsSigningKey.key",
        "WSO2_AUTH": {
          "staticToken": "0706c62f-c022-3c42-8d14-8b5df128876d",
          "tokenEndpoint": "",
          "clientKey": "test-client-key",
          "clientSecret": "test-client-secret",
          "refreshSeconds": 3600
        },
        "TLS": {
          "mutualTLS": {
            "enabled": false
          },
          "creds": {
            "ca": "/secrets/client.crt",
            "cert": "/secrets/client.crt",
            "key": "/secrets/client.crt"
          }
        }
      },
      "DATABASE": {
        "client": "mysql",
        "version": "5.5",
        "connection": {
          "host": "{{ .Values.config.db_host }}",
          "port": {{ .Values.config.db_port }},
          "user": "{{ .Values.config.db_user }}",
          "password": "{{ .Values.config.db_password }}",
          "database": "{{ .Values.config.db_database }}",
          "timezone": "UTC"
        },
        "pool": {
          "min": 10,
          "max": 10,
          "acquireTimeoutMillis": 30000,
          "createTimeoutMillis": 30000,
          "destroyTimeoutMillis": 5000,
          "idleTimeoutMillis": 30000,
          "reapIntervalMillis": 1000,
          "createRetryIntervalMillis": 200
        },
        "migrations": {
          "tableName": "migration",
          "loadExtensions": [
            ".js"
          ]
        },
        "seeds": {
          "loadExtensions": [
            ".js"
          ]
        }
      },
      "DEMO_SKIP_VALIDATION_FOR_CREDENTIAL_IDS": [
        "Jfo5k6w4np09IUtYNHnxMM696jJHqvccUdBmd0xP6XEWwH0xLei1PUzDJCM19SZ3A2Ex0fNLw0nc2hrIlFnAtw=="
      ]
    }

## @param initContainers Add additional init containers to the %%MAIN_CONTAINER_NAME%% pod(s)
## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
## e.g:
## initContainers:
##  - name: your-image-name
##    image: your-image
##    imagePullPolicy: Always
##    command: ['sh', '-c', 'echo "hello world"']
##    env:
##      - name: debug
##        value: trace
##
# initContainers: []
initContainers: |
  - name: wait-for-redis
    image: redis:7.0.5
    imagePullPolicy: IfNotPresent
    command:
      - sh
      - -c
      - until redis-cli -h ${REDIS_HOST} -p ${REDIS_PORT} ping;
        do
          echo --------------------;
          echo Waiting for Redis...;
          sleep 2;
        done;
        echo ====================;
        echo Redis ok!;
    env:
      - name: REDIS_HOST
        value: {{ include "common.tplvalues.render" (dict "value" .Values.config.redis_host "context" $) | quote }}
      - name: REDIS_PORT
        value: {{ .Values.config.redis_port | quote }}
  - name: wait-for-mysql
    image: mysql:5.7
    imagePullPolicy: IfNotPresent
    command:
      - sh
      - -c
      - |
        until mysql -h ${DB_HOST} -P ${DB_PORT} -u ${DB_USER} --password=${DB_PASSWORD}  ${DB_DATABASE} -e 'select version()' ; 
        do
          echo --------------------;
          echo Waiting for MySQL...;
          sleep 2; 
        done;
        echo ====================; 
        echo MySQL ok!;
    env:
      - name: DB_HOST
        value: '{{ .Values.config.db_host }}'
      - name: DB_PORT
        value: '{{ .Values.config.db_port }}'
      - name: DB_USER
        value: '{{ .Values.config.db_user }}'
      - name: DB_PASSWORD
        {{- if .Values.config.db_secret }}
        valueFrom:
            secretKeyRef:
              name: '{{ .Values.config.db_secret.name }}'
              key: '{{ .Values.config.db_secret.key }}'
        {{- else }}
        value: {{ .Values.config.db_password }}
        {{- end }}
      - name: DB_DATABASE
        value: '{{ .Values.config.db_database }}'
  - name: run-migration
    image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
    imagePullPolicy: IfNotPresent
    command:
      - sh
      - -c
      - npm run migrate
    env:
      - name: DB_CONNECTION_PASSWORD
        {{- if .Values.config.db_secret }}
        valueFrom:
            secretKeyRef:
              name: '{{ .Values.config.db_secret.name }}'
              key: '{{ .Values.config.db_secret.key }}'
        {{- else }}
        value: {{ .Values.config.db_password }}
        {{- end }}
      - name: NODE_ENV
        value: production
    volumeMounts:
      - name: auth-svc-config-volume
        mountPath: /opt/app/dist/config/production.json
        subPath: production.json

## @param master.podLabels Extra labels for pod(s)
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
##
podLabels: {}

## @param podAnnotations Additional custom annotations for pod(s)
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
##
podAnnotations: {}

service:
  internalPort: 4004
  ## @param service.type %%MAIN_CONTAINER_NAME%% service type
  ##
  type: ClusterIP
  ## @param service.port %%MAIN_CONTAINER_NAME%% service HTTP port
  ##
  port: 80
  ## @param service.clusterIP %%MAIN_CONTAINER_NAME%% service Cluster IP
  ## e.g.:
  ## clusterIP: None
  ##
  clusterIP:
  ## @param service.loadBalancerIP %%MAIN_CONTAINER_NAME%% service Load Balancer IP
  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer
  ##
  loadBalancerIP:
  ## @param service.loadBalancerSourceRanges %%MAIN_CONTAINER_NAME%% service Load Balancer sources
  ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
  ## e.g:
  ## loadBalancerSourceRanges:
  ##   - 10.10.10.0/24
  ##
  loadBalancerSourceRanges: []
  ## @param service.externalTrafficPolicy %%MAIN_CONTAINER_NAME%% service external traffic policy
  ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
  ##
  externalTrafficPolicy: Cluster
  ## @param service.annotations Additional custom annotations for %%MAIN_CONTAINER_NAME%% service
  ##
  annotations: {}
  ## @param master.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"
  ## If "ClientIP", consecutive client requests will be directed to the same Pod
  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
  ##
  sessionAffinity: None
  ## @param master.service.sessionAffinityConfig Additional settings for the sessionAffinity
  ## sessionAffinityConfig:
  ##   clientIP:
  ##     timeoutSeconds: 300
  ##
  sessionAffinityConfig: {}

ingress:
  ## @param ingress.enabled Enable ingress record generation for %%MAIN_CONTAINER_NAME%%
  ##
  enabled: false
  ## @param ingress.pathType Ingress path type
  ##
  pathType: ImplementationSpecific
  ## @param ingress.apiVersion Force Ingress API version (automatically detected if not set)
  ##
  apiVersion:
  ## @param ingress.hostname Default host for the ingress record
  ##
  hostname: auth-service.local
  ## @param ingress.path Default path for the ingress record
  ## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers
  ##
  path: /
  ## @param ingress.annotations Additional custom annotations for the ingress record
  ## NOTE: If `ingress.certManager=true`, annotation `kubernetes.io/tls-acme: "true"` will automatically be added
  ##
  annotations: {}
  ## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter
  ## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`
  ## You can:
  ##   - Use the `ingress.secrets` parameter to create this TLS secret
  ##   - Relay on cert-manager to create it by setting `ingress.certManager=true`
  ##   - Relay on Helm to create self-signed certificates by setting `ingress.selfSigned=true`
  ##
  tls: false
  ## @param ingress.certManager Add the corresponding annotations for cert-manager integration
  ##
  certManager: false
  ## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm
  ##
  selfSigned: false
  ## @param ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record
  ## e.g:
  ## extraHosts:
  ##   - name: transfer-api-svc.local
  ##     path: /
  ##
  extraHosts: []
  ## @param ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host
  ## e.g:
  ## extraPaths:
  ## - path: /*
  ##   backend:
  ##     serviceName: ssl-redirect
  ##     servicePort: use-annotation
  ##
  extraPaths: []
  ## @param ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record
  ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
  ## e.g:
  ## extraTls:
  ## - hosts:
  ##     - transfer-api-svc.local
  ##   secretName: transfer-api-svc.local-tls
  ##
  extraTls: []
  ## @param ingress.secrets Custom TLS certificates as secrets
  ## NOTE: 'key' and 'certificate' are expected in PEM format
  ## NOTE: 'name' should line up with a 'secretName' set further up
  ## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates
  ## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days
  ## It is also possible to create and manage the certificates outside of this helm chart
  ## Please see README.md for more information
  ## e.g:
  ## secrets:
  ##   - name: transfer-api-svc.local-tls
  ##     key: |-
  ##       -----BEGIN RSA PRIVATE KEY-----
  ##       ...
  ##       -----END RSA PRIVATE KEY-----
  ##     certificate: |-
  ##       -----BEGIN CERTIFICATE-----
  ##       ...
  ##       -----END CERTIFICATE-----
  ##
  secrets: []
  className: "nginx"