# MariaDB for EJBCA.
#
# WHY A REAL DATABASE AND NOT THE EMBEDDED H2: the EJBCA container can run on an
# internal H2 database for a quick look, but H2 is explicitly not supported for
# anything you intend to keep. Since this sandbox CA has to be *promotable* to
# production (your decision: "sandbox first and upgrade later"), the database is
# the one thing that must not need re-platforming later — every certificate ever
# issued, every revocation, and the intermediate CA key all live in here.
#
# THIS PVC IS THE CROWN JEWELS. See README.md § Backup.
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ejbca-db-data
  namespace: vnc-ca
spec:
  accessModes: [ReadWriteOnce]
  # microk8s default. Confirm with `kubectl get sc` and match your cluster.
  storageClassName: microk8s-hostpath
  resources:
    requests:
      storage: 8Gi
---
apiVersion: v1
kind: Service
metadata:
  name: ejbca-db
  namespace: vnc-ca
spec:
  type: ClusterIP
  selector:
    app: ejbca-db
  ports:
    - name: mysql
      port: 3306
      targetPort: 3306
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ejbca-db
  namespace: vnc-ca
spec:
  replicas: 1
  # Never run two replicas against one RWO volume, and never roll a new pod up
  # while the old one still holds the data directory.
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: ejbca-db
  template:
    metadata:
      labels:
        app: ejbca-db
    spec:
      containers:
        - name: mariadb
          image: mariadb:11.4
          args:
            - --character-set-server=utf8mb4
            - --collation-server=utf8mb4_unicode_ci
            # EJBCA is case-sensitive about its own table names.
            - --lower_case_table_names=0
          envFrom:
            - secretRef:
                name: ejbca-db
          ports:
            - containerPort: 3306
          volumeMounts:
            - name: data
              mountPath: /var/lib/mysql
          readinessProbe:
            exec:
              command: ["healthcheck.sh", "--connect", "--innodb_initialized"]
            initialDelaySeconds: 15
            periodSeconds: 10
          livenessProbe:
            exec:
              command: ["healthcheck.sh", "--connect"]
            initialDelaySeconds: 60
            periodSeconds: 30
          resources:
            requests:
              cpu: 100m
              memory: 512Mi
            limits:
              memory: 2Gi
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: ejbca-db-data