zz-default.provisioners.yaml

# This example provisioner is a fake resource type used to demonstrate the template provisioner mechanism. The URI should
# be a unique indicator of the provisioner. The scheme indicates how it is executed.
- uri: template://example-provisioners/example-provisioner
  # (Required) Which resource type to match
  type: example-provisioner-resource
  # (Optional) Which 'class' of the resource. Null will match any class, a non-empty value like 'default' will match
  # only resources of that class.
  class: null
  # (Optional) The exact resource id to match. Null will match any resource, a non-empty value will only match
  # the resource with exact same id.
  id: null
  # (Optional) The init template sets the initial context values on each provision request. This is a text template
  # that must evaluate to a YAML/JSON key-value map.
  init: |
    key: value
    # sprig functions are also supported
    key2: {{ print "value" | upper }}
    # other attributes are available such as Type, Class, Id, Uid, Guid.
    my-uid: "{{ .Uid }}#{{ .Guid }}"
  # (Optional) The state template gets evaluated next and sets the internal state of this resource based on the previous
  # state and the init context. Like init, this evaluates to a YAML/JSON object. This is the template that allows
  # state to be stored between each generate call.
  state: |
    stateKey: {{ .Init.key }} # will copy the value from init
    stateKey2: {{ default 0 .State.stateKey2 | add 1 }} # will increment on each provision attempt
  # (Optional) The shared state template is like state, but is a key-value structure shared between all resources.
  # This can be used to coordinate shared resources and state between resources of the same or related types.
  shared: |
    section:
      key: {{ .Shared.foo }}
  # (Optional) The outputs template gets evaluated last and translates into the outputs available as placeholder
  # references like ${resources.my-resource.key}.
  outputs: |
    plaintext: my-value
    nested:
      example: thing
    # Instead of returning secret outputs as plaintext. They can be embedded as reference to Kubernetes Secrets. When
    # these are detected, they can be used in environment variables or file contents securely.
    secret-reference: {{ encodeSecretRef "my-secret" "my-key" }}
  # (Optional) The manifests template gets evaluated as a list of Kubernetes object manifests to be added to the output.
  manifests: |
    - apiVersion: v1
      kind: ConfigMap
      metadata:
        name: cfg-{{ .Guid }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
      data:
        key: {{ .Init.key }}

# The 'cmd' scheme has a "host" + path component that indicates the path to the binary to execute. If the host starts
# with "." it is interpreted as a relative path, if it starts with "~" it resolves to the home directory.
- uri: cmd://bash#example-provisioner
  type: example-provisioner-resource
  class: default
  id: specific
  # (Optional) additional args that the binary gets run with
  # If any of the args are '<mode>' it will be replaced with "provision"
  args: ["-c", "echo '{\"resource_outputs\":{\"key\":\"value\"},\"manifests\":[]}'"]

# The default provisioner for service resources, this expects a workload and port name and will return the hostname and
# port required to contact it. This will validate that the workload and port exist, but won't enforce a dependency
# relationship yet.
- uri: template://default-provisioners/service-port
  type: service-port
  outputs: |
    {{ if not .Params.workload }}{{ fail "expected 'workload' param for the target workload name" }}{{ end }}
    {{ if not .Params.port }}{{ fail "expected 'port' param for the name of the target workload service port" }}{{ end }}
    {{ $w := (index .WorkloadServices .Params.workload) }}
    {{ if not $w }}{{ fail "unknown workload" }}{{ end }}
    {{ $p := (index $w.Ports .Params.port) }}
    {{ if not $p }}{{ fail "unknown service port" }}{{ end }}
    hostname: {{ $w.ServiceName | quote }}
    port: {{ $p.TargetPort }}

# As an example we have a 'volume' type which returns an emptyDir volume.
# In production or for real applications you may want to replace this with a provisioner for a tmpfs, host path, or
# persistent volume and claims.
- uri: template://default-provisioners/volume
  type: volume
  outputs: |
    source:
      emptyDir: {}

# The default dns provisioner just outputs a random localhost domain because we don't know whether external-dns is
# available. You should replace this with your own dns name generation that matches your external-dns controller.
- uri: template://default-provisioners/dns
  type: dns
  init: |
    randomHostname: dns{{ randAlphaNum 6 | lower }}.localhost
  state: |
    instanceHostname: {{ dig "instanceHostname" .Init.randomHostname .State | quote }}
  outputs: |
    host: {{ .State.instanceHostname }}

# Routes could be implemented as either traditional ingress resources or using the newer gateway API.
# In this default provisioner we use the gateway API with some sensible defaults. But you may wish to replace this.
- uri: template://default-provisioners/route
  type: route
  init: |
    {{ if not (regexMatch "^/|(/([^/]+))+$" .Params.path) }}{{ fail "params.path start with a / but cannot end with /" }}{{ end }}
    {{ if not (regexMatch "^[a-z0-9_.-]{1,253}$" .Params.host) }}{{ fail (cat "params.host must be a valid hostname but was" .Params.host) }}{{ end }}
    {{ $ports := (index .WorkloadServices .SourceWorkload).Ports }}
    {{ if not $ports }}{{ fail "no service ports exist" }}{{ end }}
    {{ $port := index $ports (print .Params.port) }}
    {{ if not $port.TargetPort }}{{ fail "params.port is not a named service port" }}{{ end }}
  state: |
    routeName: route-{{ .SourceWorkload }}-{{ substr 0 8 .Guid | lower }}
  manifests: |
    - apiVersion: gateway.networking.k8s.io/v1
      kind: HTTPRoute
      metadata:
        name: {{ .State.routeName }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.routeName }}
          app.kubernetes.io/instance: {{ .State.routeName }}
      spec:
        parentRefs:
        - name: default
        hostnames:
        - {{ .Params.host | quote }}
        rules:
        - matches:
          - path:
              type: PathPrefix
              value: {{ .Params.path | quote }}
          backendRefs:
          - name: {{ (index .WorkloadServices .SourceWorkload).ServiceName }}
            port: {{ .Params.port }}

- uri: template://default-provisioners/postgres
  type: postgres
  init: |
    randomDatabase: db-{{ randAlpha 8 }}
    randomUsername: user-{{ randAlpha 8 }}
    randomPassword: {{ randAlphaNum 16 | quote }}
  state: |
    service: pg-{{ .SourceWorkload }}-{{ substr 0 8 .Guid | lower }}
    database: {{ dig "database" .Init.randomDatabase .State | quote }}
    username: {{ dig "username" .Init.randomUsername .State | quote }}
    password: {{ dig "password" .Init.randomPassword .State | quote }}
  outputs: |
    host: {{ .State.service }}
    port: 5432
    name: {{ .State.database }}
    database: {{ .State.database }}
    username: {{ .State.username }}
    password: {{ encodeSecretRef .State.service "password" }}
  manifests: |
    - apiVersion: v1
      kind: Secret
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      data:
        password: {{ .State.password | b64enc }}
    - apiVersion: apps/v1
      kind: StatefulSet
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      spec:
        replicas: 1
        serviceName: {{ .State.service }}
        selector:
          matchLabels:
            app.kubernetes.io/instance: {{ .State.service }}
        template:
          metadata:
            labels:
              app.kubernetes.io/managed-by: score-k8s
              app.kubernetes.io/name: {{ .State.service }}
              app.kubernetes.io/instance: {{ .State.service }}
            annotations:
              k8s.score.dev/source-workload: {{ .SourceWorkload }}
              k8s.score.dev/resource-uid: {{ .Uid }}
              k8s.score.dev/resource-guid: {{ .Guid }}
          spec:
            automountServiceAccountToken: false
            containers:
            - name: postgres-db
              image: postgres:17-alpine
              ports:
              - name: postgres
                containerPort: 5432
              env:
              - name: PGDATA
                value: /var/lib/postgresql/data/pgdata
              - name: POSTGRES_USER
                value: {{ .State.username | quote }}
              - name: POSTGRES_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: {{ .State.service }}
                    key: password
              - name: POSTGRES_DB
                value: {{ .State.database | quote }}
              volumeMounts:
              - name: pv-data
                mountPath: /var/lib/postgresql/data
              securityContext:
                runAsUser: 1000
                runAsGroup: 1000
                allowPrivilegeEscalation: false
                privileged: false
                capabilities:
                  drop:
                    - ALL
              readinessProbe:
                exec:
                  command:
                  - pg_isready
                  - -U
                  - {{ .State.username | quote }}
                  - -d
                  - {{ .State.database | quote }}
                periodSeconds: 3
            securityContext:
              runAsNonRoot: true
              fsGroup: 1000
              seccompProfile:
                type: RuntimeDefault
        volumeClaimTemplates:
        - metadata:
            name: pv-data
            annotations:
              k8s.score.dev/source-workload: {{ .SourceWorkload }}
              k8s.score.dev/resource-uid: {{ .Uid }}
              k8s.score.dev/resource-guid: {{ .Guid }}
            labels:
              app.kubernetes.io/managed-by: score-k8s
              app.kubernetes.io/name: {{ .State.service }}
              app.kubernetes.io/instance: {{ .State.service }}
          spec:
            accessModes: ["ReadWriteOnce"]
            resources:
              requests:
                storage: 1Gi
    - apiVersion: v1
      kind: Service
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      spec:
        selector:
          app.kubernetes.io/instance: {{ .State.service }}
        type: ClusterIP
        ports:
        - port: 5432
          targetPort: 5432

- uri: template://default-provisioners/redis
  type: redis
  init: |
    randomPassword: {{ randAlphaNum 16 | quote }}
  state: |
    service: redis-{{ .SourceWorkload }}-{{ substr 0 8 .Guid | lower }}
    username: default
    password: {{ dig "password" .Init.randomPassword .State | quote }}
  outputs: |
    host: {{ .State.service }}
    port: 6379
    username: {{ .State.username }}
    password: {{ encodeSecretRef .State.service "password" }}
  manifests: |
    - apiVersion: v1
      kind: Secret
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      data:
        password: {{ .State.password | b64enc }}
        redis.conf: {{ printf "requirepass %s\nport 6379\nsave 60 1\nloglevel warning\n" .State.password | b64enc }}
    - apiVersion: apps/v1
      kind: StatefulSet
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      spec:
        replicas: 1
        serviceName: {{ .State.service }}
        selector:
          matchLabels:
            app.kubernetes.io/instance: {{ .State.service }}
        template:
          metadata:
            labels:
              app.kubernetes.io/managed-by: score-k8s
              app.kubernetes.io/name: {{ .State.service }}
              app.kubernetes.io/instance: {{ .State.service }}
            annotations:
              k8s.score.dev/source-workload: {{ .SourceWorkload }}
              k8s.score.dev/resource-uid: {{ .Uid }}
              k8s.score.dev/resource-guid: {{ .Guid }}
          spec:
            automountServiceAccountToken: false
            containers:
            - name: redis
              image: redis:7-alpine
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                    - ALL
                privileged: false
                readOnlyRootFilesystem: true
              ports:
              - name: redis
                containerPort: 6379
              volumeMounts:
              - name: redis-data
                mountPath: /data
              - name: config
                mountPath: /usr/local/etc/redis
              readinessProbe:
                exec:
                  command:
                  - redis-cli
                  - ping
                periodSeconds: 3
            securityContext:
              fsGroup: 1000
              runAsGroup: 1000
              runAsNonRoot: true
              runAsUser: 1000
              seccompProfile:
                type: RuntimeDefault
            volumes:
            - name: config
              secret:
                secretName: {{ .State.service }}
                items:
                - key: redis.conf
                  path: redis.conf
        volumeClaimTemplates:
        - metadata:
            name: redis-data
            annotations:
              k8s.score.dev/source-workload: {{ .SourceWorkload }}
              k8s.score.dev/resource-uid: {{ .Uid }}
              k8s.score.dev/resource-guid: {{ .Guid }}
            labels:
              app.kubernetes.io/managed-by: score-k8s
              app.kubernetes.io/name: {{ .State.service }}
              app.kubernetes.io/instance: {{ .State.service }}
          spec:
            accessModes: ["ReadWriteOnce"]
            resources:
              requests:
                storage: 1Gi
    - apiVersion: v1
      kind: Service
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      spec:
        selector:
          app.kubernetes.io/instance: {{ .State.service }}
        type: ClusterIP
        ports:
        - port: 6379
          targetPort: 6379

- uri: template://default-provisioners/mysql
  type: mysql
  init: |
    randomDatabase: db-{{ randAlpha 8 }}
    randomUsername: user-{{ randAlpha 8 }}
    randomPassword: {{ randAlphaNum 16 | quote }}
  state: |
    service: mysql-{{ .SourceWorkload }}-{{ substr 0 8 .Guid | lower }}
    database: {{ dig "database" .Init.randomDatabase .State | quote }}
    username: {{ dig "username" .Init.randomUsername .State | quote }}
    password: {{ dig "password" .Init.randomPassword .State | quote }}
  outputs: |
    host: {{ .State.service }}
    port: 3306
    name: {{ .State.database }}
    database: {{ .State.database }}
    username: {{ .State.username }}
    password: {{ encodeSecretRef .State.service "MYSQL_PASSWORD" }}
  manifests: |
    - apiVersion: v1
      kind: Secret
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      data:
        MYSQL_PASSWORD: {{ .State.password | b64enc }}
        MYSQL_ROOT_PASSWORD: {{ .State.password | b64enc }}
    - apiVersion: apps/v1
      kind: StatefulSet
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      spec:
        replicas: 1
        serviceName: {{ .State.service }}
        selector:
          matchLabels:
            app.kubernetes.io/instance: {{ .State.service }}
        template:
          metadata:
            labels:
              app.kubernetes.io/managed-by: score-k8s
              app.kubernetes.io/name: {{ .State.service }}
              app.kubernetes.io/instance: {{ .State.service }}
            annotations:
              k8s.score.dev/source-workload: {{ .SourceWorkload }}
              k8s.score.dev/resource-uid: {{ .Uid }}
              k8s.score.dev/resource-guid: {{ .Guid }}
          spec:
            containers:
            - name: mysql-db
              image: mysql:8.0
              ports:
              - name: mysql
                containerPort: 3306
              env:
              - name: MYSQL_USER
                value: {{ .State.username | quote }}
              - name: MYSQL_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: {{ .State.service }}
                    key: MYSQL_PASSWORD
              - name: MYSQL_ROOT_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: {{ .State.service }}
                    key: MYSQL_ROOT_PASSWORD
              - name: MYSQL_DATABASE
                value: {{ .State.database | quote }}
              volumeMounts:
              - name: data
                mountPath: /var/lib/mysql
              readinessProbe:
                exec:
                  command:
                  - mysqladmin
                  - ping
                  - -h
                  - localhost
                periodSeconds: 3
        volumeClaimTemplates:
        - metadata:
            name: data
            annotations:
              k8s.score.dev/source-workload: {{ .SourceWorkload }}
              k8s.score.dev/resource-uid: {{ .Uid }}
              k8s.score.dev/resource-guid: {{ .Guid }}
            labels:
              app.kubernetes.io/managed-by: score-k8s
              app.kubernetes.io/name: {{ .State.service }}
              app.kubernetes.io/instance: {{ .State.service }}
          spec:
            accessModes: ["ReadWriteOnce"]
            resources:
              requests:
                storage: 1Gi
    - apiVersion: v1
      kind: Service
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      spec:
        selector:
          app.kubernetes.io/instance: {{ .State.service }}
        type: ClusterIP
        ports:
        - port: 3306
          targetPort: 3306

- uri: template://default-provisioners/mongo
  type: mongodb
  init: |
    randomDatabase: db-{{ randAlpha 8 }}
    randomUsername: user-{{ randAlpha 8 }}
    randomPassword: {{ randAlphaNum 16 | quote }}
  state: |
    service: mongo-{{ .SourceWorkload }}-{{ substr 0 8 .Guid | lower }}
    database: {{ dig "database" .Init.randomDatabase .State | quote }}
    username: {{ dig "username" .Init.randomUsername .State | quote }}
    password: {{ dig "password" .Init.randomPassword .State | quote }}
  outputs: |
    host: {{ .State.service }}
    port: 27017
    name: {{ .State.database }}
    connection: "mongodb://{{ .State.username }}:{{ .State.password }}@{{ .State.service }}:27017/"
    username: {{ .State.username }}
    password: {{ encodeSecretRef .State.service "MONGO_INITDB_ROOT_PASSWORD" }}
  manifests: |
    - apiVersion: v1
      kind: Secret
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      data:
        MONGO_INITDB_ROOT_PASSWORD: {{ .State.password | b64enc }}
    - apiVersion: apps/v1
      kind: StatefulSet
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      spec:
        replicas: 1
        serviceName: {{ .State.service }}
        selector:
          matchLabels:
            app.kubernetes.io/instance: {{ .State.service }}
        template:
          metadata:
            labels:
              app.kubernetes.io/managed-by: score-k8s
              app.kubernetes.io/name: {{ .State.service }}
              app.kubernetes.io/instance: {{ .State.service }}
            annotations:
              k8s.score.dev/source-workload: {{ .SourceWorkload }}
              k8s.score.dev/resource-uid: {{ .Uid }}
              k8s.score.dev/resource-guid: {{ .Guid }}
          spec:
            automountServiceAccountToken: false
            containers:
            - name: mongo-db
              image: mongo:latest
              ports:
              - name: mongo
                containerPort: 27017
              env:
              - name: MONGO_INITDB_ROOT_USERNAME
                value: {{ .State.username | quote }}
              - name: MONGO_INITDB_ROOT_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: {{ .State.service }}
                    key: MONGO_INITDB_ROOT_PASSWORD
              livenessProbe:
                exec:
                  command:
                    - /bin/sh
                    - -c
                    - echo 'db.runCommand("ping").ok' | mongosh -u $$MONGO_INITDB_ROOT_USERNAME -p $$MONGO_INITDB_ROOT_PASSWORD
                initialDelaySeconds: 30
                timeoutSeconds: 5
                periodSeconds: 20
              securityContext:
                runAsUser: 1001
                runAsGroup: 1001
                allowPrivilegeEscalation: false
                privileged: false
                readOnlyRootFilesystem: true
                capabilities:
                  drop:
                    - ALL
              volumeMounts:
              - name: data
                mountPath: /data/db
              - name: tmp
                mountPath: /tmp
            securityContext:
              runAsNonRoot: true
              fsGroup: 1001
              seccompProfile:
                type: RuntimeDefault
            volumes:
              - name: tmp
                emptyDir: {}
        volumeClaimTemplates:
        - metadata:
            name: data
            annotations:
              k8s.score.dev/source-workload: {{ .SourceWorkload }}
              k8s.score.dev/resource-uid: {{ .Uid }}
              k8s.score.dev/resource-guid: {{ .Guid }}
            labels:
              app.kubernetes.io/managed-by: score-k8s
              app.kubernetes.io/name: {{ .State.service }}
              app.kubernetes.io/instance: {{ .State.service }}
          spec:
            accessModes: ["ReadWriteOnce"]
            resources:
              requests:
                storage: 1Gi
    - apiVersion: v1
      kind: Service
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      spec:
        selector:
          app.kubernetes.io/instance: {{ .State.service }}
        type: ClusterIP
        ports:
        - port: 27017
          targetPort: 27017

- uri: template://default-provisioners/rabbitmq
  type: amqp
  init: |
    randomVHost: vhost-{{ randAlpha 8 }}
    randomUsername: user-{{ randAlpha 8 }}
    randomPassword: {{ randAlphaNum 16 | quote }}
  state: |
    service: rabbitmq-{{ .SourceWorkload }}-{{ substr 0 8 .Guid | lower }}
    vhost: {{ dig "vhost" .Init.randomVHost .State | quote }}
    username: {{ dig "username" .Init.randomUsername .State | quote }}
    password: {{ dig "password" .Init.randomPassword .State | quote }}
  outputs: |
    host: {{ .State.service }}
    port: 5672
    vhost: {{ .State.vhost }}
    username: {{ .State.username }}
    password: {{ .State.password }}
  manifests: |
    - apiVersion: v1
      kind: Secret
      metadata:
        name: {{ .State.service }}-secret
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}-secret
          app.kubernetes.io/instance: {{ .State.service }}
      data:
        RABBITMQ_DEFAULT_VHOST: {{ .State.vhost | b64enc }}
        RABBITMQ_DEFAULT_USER: {{ .State.username | b64enc }}
        RABBITMQ_DEFAULT_PASS: {{ .State.password | b64enc }}
    - apiVersion: apps/v1
      kind: StatefulSet
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      spec:
        serviceName: {{ .State.service }}
        replicas: 1
        selector:
          matchLabels:
            app.kubernetes.io/instance: {{ .State.service }}
        template:
          metadata:
            labels:
              app.kubernetes.io/managed-by: score-k8s
              app.kubernetes.io/name: {{ .State.service }}
              app.kubernetes.io/instance: {{ .State.service }}
          spec:
            containers:
              - name: rabbitmq
                image: rabbitmq:3-management
                ports:
                  - name: amqp
                    containerPort: 5672
                  - name: management
                    containerPort: 15672
                envFrom:
                  - secretRef:
                      name: {{ .State.service }}-secret
                volumeMounts:
                  - name: data
                    mountPath: /var/lib/rabbitmq
                readinessProbe:
                  exec:
                    command:
                      - rabbitmq-diagnostics
                      - -q
                      - check_port_connectivity
                  periodSeconds: 3
                  initialDelaySeconds: 30
                  timeoutSeconds: 5
        volumeClaimTemplates:
          - metadata:
              name: data
            spec:
              accessModes: ["ReadWriteOnce"]
              resources:
                requests:
                  storage: 3Gi
    - apiVersion: v1
      kind: Service
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      spec:
        ports:
          - port: 5672
            targetPort: 5672
            name: amqp
          - port: 15672
            targetPort: 15672
            name: management
        selector:
          app.kubernetes.io/instance: {{ .State.service }}
        type: ClusterIP

- uri: template://default-provisioners/mssql
  type: mssql
  init: |
    randomPassword: {{ randAlphaNum 16 | quote }}
  state: |
    service: mssql-{{ .SourceWorkload }}-{{ substr 0 8 .Guid | lower }}
    database: master
    username: sa
    password: {{ dig "password" .Init.randomPassword .State | quote }}
  outputs: |
    server: {{ .State.service }}
    port: 1433
    connection: "Server=tcp:{{ .State.service }},1433;Initial Catalog={{ .State.database }};User ID={{ .State.username }};Password={{ encodeSecretRef .State.service "MSSQL_SA_PASSWORD" }}"
    database: {{ .State.database }}
    username: {{ .State.username }}
    password: {{ encodeSecretRef .State.service "MSSQL_SA_PASSWORD" }}
  manifests: |
    - apiVersion: v1
      kind: Secret
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      data:
        MSSQL_SA_PASSWORD: {{ .State.password | b64enc }}
    - apiVersion: apps/v1
      kind: StatefulSet
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      spec:
        replicas: 1
        serviceName: {{ .State.service }}
        selector:
          matchLabels:
            app.kubernetes.io/instance: {{ .State.service }}
        template:
          metadata:
            labels:
              app.kubernetes.io/managed-by: score-k8s
              app.kubernetes.io/name: {{ .State.service }}
              app.kubernetes.io/instance: {{ .State.service }}
            annotations:
              k8s.score.dev/source-workload: {{ .SourceWorkload }}
              k8s.score.dev/resource-uid: {{ .Uid }}
              k8s.score.dev/resource-guid: {{ .Guid }}
          spec:
            containers:
            - name: mssql-db
              image: mcr.microsoft.com/mssql/server:latest
              ports:
              - name: mssql
                containerPort: 1433
              env:
              - name: ACCEPT_EULA
                value: "Y"
              - name: MSSQL_ENABLE_HADR
                value: "1"
              - name: MSSQL_AGENT_ENABLED
                value: "1"
              - name: MSSQL_SA_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: {{ .State.service }}
                    key: MSSQL_SA_PASSWORD
              volumeMounts:
              - name: mssql
                mountPath: "/var/opt/mssql"
        volumeClaimTemplates:
        - metadata:
            name: mssql
            annotations:
              k8s.score.dev/source-workload: {{ .SourceWorkload }}
              k8s.score.dev/resource-uid: {{ .Uid }}
              k8s.score.dev/resource-guid: {{ .Guid }}
            labels:
              app.kubernetes.io/managed-by: score-k8s
              app.kubernetes.io/name: {{ .State.service }}
              app.kubernetes.io/instance: {{ .State.service }}
          spec:
            accessModes: ["ReadWriteOnce"]
            resources:
              requests:
                storage: 1Gi
    - apiVersion: v1
      kind: Service
      metadata:
        name: {{ .State.service }}
        annotations:
          k8s.score.dev/source-workload: {{ .SourceWorkload }}
          k8s.score.dev/resource-uid: {{ .Uid }}
          k8s.score.dev/resource-guid: {{ .Guid }}
        labels:
          app.kubernetes.io/managed-by: score-k8s
          app.kubernetes.io/name: {{ .State.service }}
          app.kubernetes.io/instance: {{ .State.service }}
      spec:
        selector:
          app.kubernetes.io/instance: {{ .State.service }}
        type: ClusterIP
        ports:
        - port: 1433
          targetPort: 1433