# InfluxDB 2, cluster-internal only. On first start (empty volume) the image's setup mode
# creates the org, the bucket and the admin token from the influxdb-auth Secret; on later
# starts those variables are ignored and the data on the volume wins.
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: influxdb
  namespace: mg4
  labels:
    app.kubernetes.io/name: influxdb
    app.kubernetes.io/part-of: mg4
spec:
  serviceName: influxdb
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: influxdb
  template:
    metadata:
      labels:
        app.kubernetes.io/name: influxdb
        app.kubernetes.io/part-of: mg4
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: influxdb
          image: docker.io/library/influxdb:2.7.12-alpine
          ports:
            - name: http
              containerPort: 8086
          env:
            - name: INFLUXD_REPORTING_DISABLED
              value: "true"
            - name: DOCKER_INFLUXDB_INIT_MODE
              value: setup
            - name: DOCKER_INFLUXDB_INIT_ORG
              value: mg4
            - name: DOCKER_INFLUXDB_INIT_BUCKET
              value: mg4
            - name: DOCKER_INFLUXDB_INIT_USERNAME
              value: admin
            - name: DOCKER_INFLUXDB_INIT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: influxdb-auth
                  key: admin-password
            - name: DOCKER_INFLUXDB_INIT_ADMIN_TOKEN
              valueFrom:
                secretKeyRef:
                  name: influxdb-auth
                  key: admin-token
          volumeMounts:
            - name: data
              mountPath: /var/lib/influxdb2
            - name: config
              mountPath: /etc/influxdb2
          readinessProbe:
            httpGet:
              path: /health
              port: http
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 30
            periodSeconds: 30
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              memory: 1Gi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
      volumes:
        - name: config
          emptyDir: {}
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        # No storageClassName: the cluster's default class is used.
        resources:
          requests:
            storage: 10Gi
---
apiVersion: v1
kind: Service
metadata:
  name: influxdb
  namespace: mg4
  labels:
    app.kubernetes.io/name: influxdb
    app.kubernetes.io/part-of: mg4
spec:
  selector:
    app.kubernetes.io/name: influxdb
  ports:
    - name: http
      port: 8086
      targetPort: http
---
# Only the server may reach InfluxDB. Has no effect on a CNI without NetworkPolicy support.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: influxdb-from-server-only
  namespace: mg4
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: influxdb
  policyTypes: ["Ingress"]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: mg4-server
      ports:
        - port: 8086