---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: notes-tls
  namespace: postgres-tls-test
spec:
  interval: 10m
  dependsOn:
    - name: pg-tls
  chart:
    spec:
      chart: universal-chart
      version: "0.1.9"
      sourceRef:
        kind: HelmRepository
        name: yc-oci-charts
        namespace: flux-system
      interval: 10m
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    global:
      env: _default
    services:
      backend:
        enabled: true
        deployment:
          enabled: true
          name:
            _default: notes-tls
          replicaCount:
            _default: 1
          port:
            _default: 8000
          resources:
            requests:
              cpu:
                _default: 25m
              memory:
                _default: 128Mi
          probes:
            liveness:
              enabled: false
            readiness:
              enabled: false
        image:
          name:
            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:preprod_c00faf6e
          pullPolicy:
            _default: IfNotPresent
        service:
          enabled: true
          name:
            _default: notes-tls
          type:
            _default: ClusterIP
          port:
            _default: 8000
          targetPort:
            _default: 8000
          portName:
            _default: http
        imagePullSecrets:
          enabled:
            _default: true
          name:
            _default: regcred
        envs:
          - name: PG_HOST
            value:
              _default: pg-tls.postgres-tls-test.svc.cluster.local
          - name: PG_PORT
            value:
              _default: "5432"
          - name: PG_DB
            value:
              _default: notes
          - name: PG_LOGIN
            value:
              _default: notes
          - name: PG_SSL
            value:
              _default: "true"
          - name: PG_SSL_MODE
            value:
              _default: verify-full
          - name: PGSSLMODE
            value:
              _default: verify-full
          - name: PGSSLROOTCERT
            value:
              _default: /etc/pg-ca/ca.crt
          - name: DJANGO_USE
            value:
              _default: "false"
          - name: TIMEOUT
            value:
              _default: "120"
        secretEnvs:
          - name: PG_PASSWORD
            secretName:
              _default: pg-tls
            secretKey:
              _default: password
        volumes:
          _default:
            - name: pg-ca
              mountPath: /etc/pg-ca
              readOnly: true
              secret:
                secretName: pg-tls-crt
                items:
                  - key: ca.crt
                    path: ca.crt