apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: etcd
  namespace: datastore
  labels:
    app.kubernetes.io/name: etcd
    app.kubernetes.io/component: distributed-key-value-store
spec:
  serviceName: etcd
  replicas: 3
  podManagementPolicy: Parallel
  selector:
    matchLabels:
      app.kubernetes.io/name: etcd
  template:
    metadata:
      labels:
        app.kubernetes.io/name: etcd
    spec:
      terminationGracePeriodSeconds: 60
      securityContext:
        fsGroup: 1001
        runAsNonRoot: true
      containers:
        - name: etcd
          image: quay.io/coreos/etcd:v3.5.15
          imagePullPolicy: IfNotPresent
          command:
            - /usr/local/bin/etcd
          args:
            - --name=$(POD_NAME)
            - --data-dir=/var/lib/etcd
            - --listen-client-urls=http://0.0.0.0:2379
            - --advertise-client-urls=http://$(POD_NAME).etcd.datastore.svc.cluster.local:2379
            - --listen-peer-urls=http://0.0.0.0:2380
            - --initial-advertise-peer-urls=http://$(POD_NAME).etcd.datastore.svc.cluster.local:2380
            - --initial-cluster=etcd-0=http://etcd-0.etcd.datastore.svc.cluster.local:2380,etcd-1=http://etcd-1.etcd.datastore.svc.cluster.local:2380,etcd-2=http://etcd-2.etcd.datastore.svc.cluster.local:2380
            - --initial-cluster-state=new
            - --initial-cluster-token=etcd-production
            - --auto-compaction-mode=periodic
            - --auto-compaction-retention=1h
            - --quota-backend-bytes=8589934592
            - --snapshot-count=10000
            - --metrics=extensive
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
          ports:
            - name: client
              containerPort: 2379
            - name: peer
              containerPort: 2380
            - name: metrics
              containerPort: 2381
          resources:
            requests:
              cpu: 500m
              memory: 1Gi
            limits:
              cpu: "2"
              memory: 4Gi
          readinessProbe:
            httpGet:
              path: /readyz
              port: client
            initialDelaySeconds: 10
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 6
          livenessProbe:
            httpGet:
              path: /livez
              port: client
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 3
          volumeMounts:
            - name: data
              mountPath: /var/lib/etcd
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1001
            runAsGroup: 1001
            capabilities:
              drop:
                - ALL
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes:
          - ReadWriteOnce
        storageClassName: fast-ssd
        resources:
          requests:
            storage: 50Gi
---
apiVersion: v1
kind: Service
metadata:
  name: etcd
  namespace: datastore
  labels:
    app.kubernetes.io/name: etcd
spec:
  clusterIP: None
  publishNotReadyAddresses: true
  selector:
    app.kubernetes.io/name: etcd
  ports:
    - name: client
      port: 2379
      targetPort: client
    - name: peer
      port: 2380
      targetPort: peer
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: etcd
  namespace: datastore
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: etcd