resource "kubernetes_cluster_role" "kapacitor" {

  metadata {
    name = "kapacitor-role"
  }

  rule {
    api_groups = [""]
    resources  = ["configmaps", "secrets"]
    verbs      = ["get", "watch", "list"]
  }
}

resource "kubernetes_cluster_role_binding" "kapacitor" {

  metadata {
    name = "kapacitor-role-binding"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = kubernetes_cluster_role.kapacitor.metadata.0.name
  }

  subject {
    kind      = "ServiceAccount"
    name      = kubernetes_service_account.kapacitor.metadata.0.name
    namespace = kubernetes_namespace.monitoring.metadata.0.name
  }
}

resource "kubernetes_service_account" "kapacitor" {
  metadata {
    name      = "kapacitor-sa"
    namespace = kubernetes_namespace.monitoring.metadata.0.name
  }

  automount_service_account_token = false
}

resource "kubernetes_service" "kapacitor" {
  metadata {
    name      = "kapacitor"
    namespace = kubernetes_namespace.monitoring.metadata.0.name
  }
  spec {
    port {
      port        = 9092
      name        = "api"
      target_port = "api"
    }
    selector = {
      app = "kapacitor"
    }
    cluster_ip = "None"
  }
}

resource "kubernetes_deployment" "kapacitor" {

  depends_on = [
    kubernetes_stateful_set.influxdb
  ]

  metadata {
    name      = "kapacitor"
    namespace = kubernetes_namespace.monitoring.metadata.0.name
  }

  spec {
    selector {
      match_labels = {
        app = "kapacitor"
      }
    }
    strategy {
      type = "Recreate"
    }
    template {
      metadata {
        labels = {
          app = "kapacitor"
        }
      }
      spec {
        service_account_name            = kubernetes_service_account.kapacitor.metadata.0.name
        automount_service_account_token = false
        container {
          name              = "kapacitor"
          image             = "kapacitor:${local.kapacitor_version}"
          image_pull_policy = "IfNotPresent"

          resources {
            requests = {
              memory = "100Mi"
            }
          }

          liveness_probe {
            tcp_socket {
              port = "api"
            }
            initial_delay_seconds = 10
            timeout_seconds       = 5
            period_seconds        = 10
            failure_threshold     = 6
            success_threshold     = 1
          }

          readiness_probe {
            tcp_socket {
              port = "api"
            }
            initial_delay_seconds = 10
            timeout_seconds       = 5
            period_seconds        = 10
            failure_threshold     = 6
            success_threshold     = 1
          }

          security_context {
            run_as_user                = 1000
            run_as_group               = 1000
            allow_privilege_escalation = false
          }

          env {
            name  = "KAPACITOR_HOSTNAME"
            value = "kapacitor"
          }
          env {
            name  = "KAPACITOR_INFLUXDB_0_URLS_0"
            value = "http://influxdb:8086/"
          }
          port {
            container_port = 9092
            name           = "api"
          }
          volume_mount {
            mount_path = "/var/lib/kapacitor"
            name       = "persistent-storage"
          }
        }
        volume {
          name = "persistent-storage"
          host_path {
            path = "/var/lib/monitoring/kapacitor.data"
          }
        }
      }
    }
  }
}