---
# Source: mongodb/templates/networkpolicy.yaml
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: mongodb
  namespace: "mongodb"
  labels:
    app.kubernetes.io/instance: mongodb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: mongodb
    app.kubernetes.io/version: 8.3.2
    helm.sh/chart: mongodb-19.0.7
    app.kubernetes.io/component: mongodb
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/instance: mongodb
      app.kubernetes.io/name: mongodb
      app.kubernetes.io/component: mongodb
  policyTypes:
    - Ingress
    - Egress
  egress:
    - {}
  ingress:
    - ports:
        - port: 27017
---
# Source: mongodb/templates/arbiter/pdb.yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: mongodb-arbiter
  namespace: "mongodb"
  labels:
    app.kubernetes.io/instance: mongodb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: mongodb
    app.kubernetes.io/version: 8.3.2
    helm.sh/chart: mongodb-19.0.7
    app.kubernetes.io/component: arbiter
spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: mongodb
      app.kubernetes.io/name: mongodb
      app.kubernetes.io/component: arbiter
---
# Source: mongodb/templates/replicaset/pdb.yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: mongodb
  namespace: "mongodb"
  labels:
    app.kubernetes.io/instance: mongodb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: mongodb
    app.kubernetes.io/version: 8.3.2
    helm.sh/chart: mongodb-19.0.7
    app.kubernetes.io/component: mongodb
spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: mongodb
      app.kubernetes.io/name: mongodb
      app.kubernetes.io/component: mongodb
---
# Source: mongodb/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: mongodb
  namespace: "mongodb"
  labels:
    app.kubernetes.io/instance: mongodb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: mongodb
    app.kubernetes.io/version: 8.3.2
    helm.sh/chart: mongodb-19.0.7
secrets:
  - name: mongodb-auth
automountServiceAccountToken: false
---
# Source: mongodb/templates/common-scripts-cm.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: mongodb-common-scripts
  namespace: "mongodb"
  labels:
    app.kubernetes.io/instance: mongodb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: mongodb
    app.kubernetes.io/version: 8.3.2
    helm.sh/chart: mongodb-19.0.7
    app.kubernetes.io/component: mongodb
data:
  startup-probe.sh: |
    #!/bin/bash
    exec mongosh  $TLS_OPTIONS --port $MONGODB_PORT_NUMBER --eval 'if (!(db.hello().isWritablePrimary || db.hello().secondary)) { throw new Error("Not ready") }'
  readiness-probe.sh: |
    #!/bin/bash
    # Run the proper check depending on the version
    [[ $(mongod -version | grep "db version") =~ ([0-9]+\.[0-9]+\.[0-9]+) ]] && VERSION=${BASH_REMATCH[1]}
    . /opt/bitnami/scripts/libversion.sh
    VERSION_MAJOR="$(get_sematic_version "$VERSION" 1)"
    VERSION_MINOR="$(get_sematic_version "$VERSION" 2)"
    VERSION_PATCH="$(get_sematic_version "$VERSION" 3)"
    readiness_test='db.isMaster().ismaster || db.isMaster().secondary'
    if [[ ( "$VERSION_MAJOR" -ge 5 ) || ( "$VERSION_MAJOR" -ge 4 && "$VERSION_MINOR" -ge 4 && "$VERSION_PATCH" -ge 2 ) ]]; then
        readiness_test='db.hello().isWritablePrimary || db.hello().secondary'
    fi
    exec mongosh  $TLS_OPTIONS --port $MONGODB_PORT_NUMBER --eval "if (!(${readiness_test})) { throw new Error(\"Not ready\") }"
  ping-mongodb.sh: |
    #!/bin/bash
    exec mongosh  $TLS_OPTIONS --port $MONGODB_PORT_NUMBER --eval "db.adminCommand('ping')"
---
# Source: mongodb/templates/replicaset/scripts-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: mongodb-scripts
  namespace: "mongodb"
  labels:
    app.kubernetes.io/instance: mongodb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: mongodb
    app.kubernetes.io/version: 8.3.2
    helm.sh/chart: mongodb-19.0.7
    app.kubernetes.io/component: mongodb
data:
  setup.sh: |-
    #!/bin/bash

    . /opt/bitnami/scripts/mongodb-env.sh
    . /opt/bitnami/scripts/libfs.sh
    . /opt/bitnami/scripts/liblog.sh
    . /opt/bitnami/scripts/libvalidations.sh

    if is_empty_value "$MONGODB_ADVERTISED_PORT_NUMBER"; then
      export MONGODB_ADVERTISED_PORT_NUMBER="$MONGODB_PORT_NUMBER"
    fi

    info "Advertised Hostname: $MONGODB_ADVERTISED_HOSTNAME"
    info "Advertised Port: $MONGODB_ADVERTISED_PORT_NUMBER"

    # Check for existing replica set in case there is no data in the PVC
    # This is for cases where the PVC is lost or for MongoDB caches without
    # persistence
    current_primary=""
    if is_dir_empty "${MONGODB_DATA_DIR}/db"; then
      info "Data dir empty, checking if the replica set already exists"
        current_primary=$(mongosh admin --host "mongodb-0.mongodb-headless.mongodb.svc.cluster.local:27017,mongodb-1.mongodb-headless.mongodb.svc.cluster.local:27017" --authenticationDatabase admin -u $MONGODB_ROOT_USER -p $MONGODB_ROOT_PASSWORD --eval 'db.runCommand("ismaster")' | awk -F\' '/primary:/ {print $2}')
      if ! is_empty_value "$current_primary"; then
        info "Detected existing primary: ${current_primary}"
      fi
    fi

    if ! is_empty_value "$current_primary" && [[ "$MONGODB_ADVERTISED_HOSTNAME:$MONGODB_ADVERTISED_PORT_NUMBER" == "$current_primary" ]]; then
        info "Advertised name matches current primary, configuring node as a primary"
        export MONGODB_REPLICA_SET_MODE="primary"
    elif ! is_empty_value "$current_primary" && [[ "$MONGODB_ADVERTISED_HOSTNAME:$MONGODB_ADVERTISED_PORT_NUMBER" != "$current_primary" ]]; then
        info "Current primary is different from this node. Configuring the node as replica of ${current_primary}"
        export MONGODB_REPLICA_SET_MODE="secondary"
        export MONGODB_INITIAL_PRIMARY_HOST="${current_primary%:*}"
        export MONGODB_INITIAL_PRIMARY_PORT_NUMBER="${current_primary#*:}"
        export MONGODB_SET_SECONDARY_OK="yes"
    elif [[ "$MY_POD_NAME" = "mongodb-0" ]]; then
        info "Pod name matches initial primary pod name, configuring node as a primary"
        export MONGODB_REPLICA_SET_MODE="primary"
    else
        info "Pod name doesn't match initial primary pod name, configuring node as a secondary"
        export MONGODB_REPLICA_SET_MODE="secondary"
        export MONGODB_INITIAL_PRIMARY_PORT_NUMBER="$MONGODB_PORT_NUMBER"
    fi

    if [[ "$MONGODB_REPLICA_SET_MODE" == "secondary" ]]; then
        export MONGODB_INITIAL_PRIMARY_ROOT_USER="$MONGODB_ROOT_USER"
        export MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD="$MONGODB_ROOT_PASSWORD"
        export MONGODB_ROOT_PASSWORD=""
        export MONGODB_EXTRA_USERNAMES=""
        export MONGODB_EXTRA_DATABASES=""
        export MONGODB_EXTRA_PASSWORDS=""
        export MONGODB_ROOT_PASSWORD_FILE=""
        export MONGODB_EXTRA_USERNAMES_FILE=""
        export MONGODB_EXTRA_DATABASES_FILE=""
        export MONGODB_EXTRA_PASSWORDS_FILE=""
    fi
    exec /opt/bitnami/scripts/mongodb/entrypoint.sh /opt/bitnami/scripts/mongodb/run.sh
  setup-hidden.sh: |-
    #!/bin/bash

    . /opt/bitnami/scripts/mongodb-env.sh

    echo "Advertised Hostname: $MONGODB_ADVERTISED_HOSTNAME"
    echo "Advertised Port: $MONGODB_ADVERTISED_PORT_NUMBER"
    echo "Configuring node as a hidden node"
    export MONGODB_REPLICA_SET_MODE="hidden"
    export MONGODB_INITIAL_PRIMARY_ROOT_USER="$MONGODB_ROOT_USER"
    export MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD="$MONGODB_ROOT_PASSWORD"
    export MONGODB_INITIAL_PRIMARY_PORT_NUMBER="$MONGODB_PORT_NUMBER"
    export MONGODB_ROOT_PASSWORD=""
    export MONGODB_EXTRA_USERNAMES=""
    export MONGODB_EXTRA_DATABASES=""
    export MONGODB_EXTRA_PASSWORDS=""
    export MONGODB_ROOT_PASSWORD_FILE=""
    export MONGODB_EXTRA_USERNAMES_FILE=""
    export MONGODB_EXTRA_DATABASES_FILE=""
    export MONGODB_EXTRA_PASSWORDS_FILE=""
    exec /opt/bitnami/scripts/mongodb/entrypoint.sh /opt/bitnami/scripts/mongodb/run.sh
---
# Source: mongodb/templates/arbiter/headless-svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: mongodb-arbiter-headless
  namespace: "mongodb"
  labels:
    app.kubernetes.io/instance: mongodb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: mongodb
    app.kubernetes.io/version: 8.3.2
    helm.sh/chart: mongodb-19.0.7
    app.kubernetes.io/component: arbiter
spec:
  type: ClusterIP
  clusterIP: None
  ports:
    - name: tcp-mongodb
      port: 27017
      targetPort: mongodb
  selector:
    app.kubernetes.io/instance: mongodb
    app.kubernetes.io/name: mongodb
    app.kubernetes.io/component: arbiter
---
# Source: mongodb/templates/replicaset/headless-svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: mongodb-headless
  namespace: "mongodb"
  labels:
    app.kubernetes.io/instance: mongodb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: mongodb
    app.kubernetes.io/version: 8.3.2
    helm.sh/chart: mongodb-19.0.7
    app.kubernetes.io/component: mongodb
spec:
  type: ClusterIP
  clusterIP: None
  publishNotReadyAddresses: true
  ports:
    - name: "mongodb"
      port: 27017
      targetPort: mongodb
  selector:
    app.kubernetes.io/instance: mongodb
    app.kubernetes.io/name: mongodb
    app.kubernetes.io/component: mongodb
---
# Source: mongodb/templates/arbiter/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mongodb-arbiter
  namespace: "mongodb"
  labels:
    app.kubernetes.io/instance: mongodb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: mongodb
    app.kubernetes.io/version: 8.3.2
    helm.sh/chart: mongodb-19.0.7
    app.kubernetes.io/component: arbiter
spec:
  serviceName: mongodb-arbiter-headless
  podManagementPolicy: OrderedReady
  replicas: 1
  updateStrategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app.kubernetes.io/instance: mongodb
      app.kubernetes.io/name: mongodb
      app.kubernetes.io/component: arbiter
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: mongodb
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: mongodb
        app.kubernetes.io/version: 8.3.2
        helm.sh/chart: mongodb-19.0.7
        app.kubernetes.io/component: arbiter
    spec:

      serviceAccountName: mongodb
      affinity:
        podAffinity:

        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/instance: mongodb
                    app.kubernetes.io/name: mongodb
                    app.kubernetes.io/component: mongodb
                topologyKey: kubernetes.io/hostname
              weight: 1
        nodeAffinity:

      automountServiceAccountToken: false
      securityContext:
        fsGroup: 1001
        fsGroupChangePolicy: Always
        supplementalGroups: []
        sysctls: []

      enableServiceLinks: true
      initContainers:
      containers:
        - name: mongodb-arbiter
          image: registry-1.docker.io/bitnami/mongodb@sha256:594309a857f5254bc2ee6b5e538f680696f9c7e2bf20279ca3fec49f682de44e
          imagePullPolicy: "IfNotPresent"
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: true
            runAsGroup: 1001
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: {}
            seccompProfile:
              type: RuntimeDefault
          env:
            - name: BITNAMI_DEBUG
              value: "false"
            - name: MY_POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: MY_POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: MONGODB_REPLICA_SET_MODE
              value: "arbiter"
            - name: MONGODB_INITIAL_PRIMARY_HOST
              value: "mongodb-0.mongodb-headless.$(MY_POD_NAMESPACE).svc.cluster.local"
            - name: MONGODB_REPLICA_SET_NAME
              value: "rs0"
            - name: OPENSSL_FIPS
              value: "yes"
            - name: MONGODB_ADVERTISED_HOSTNAME
              value: "$(MY_POD_NAME).mongodb-arbiter-headless.$(MY_POD_NAMESPACE).svc.cluster.local"
            - name: MONGODB_PORT_NUMBER
              value: "27017"
            - name: MONGODB_ENABLE_IPV6
              value: "no"
            - name: MONGODB_INITIAL_PRIMARY_ROOT_USER
              value: "root"
            - name: MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD_FILE
              value: "/opt/bitnami/mongodb/secrets/mongodb-root-password"
            - name: MONGODB_REPLICA_SET_KEY_FILE
              value: "/opt/bitnami/mongodb/secrets/mongodb-replica-set-key"
            - name: ALLOW_EMPTY_PASSWORD
              value: "no"
          ports:
            - containerPort: 27017
              name: mongodb
          livenessProbe:
            failureThreshold: 6
            initialDelaySeconds: 30
            periodSeconds: 20
            successThreshold: 1
            timeoutSeconds: 10
            exec:
              command:
                - pgrep
                - mongod
          readinessProbe:
            failureThreshold: 6
            initialDelaySeconds: 5
            periodSeconds: 20
            successThreshold: 1
            timeoutSeconds: 10
            tcpSocket:
              port: mongodb
          resources:
            limits:
              cpu: 750m
              ephemeral-storage: 2Gi
              memory: 768Mi
            requests:
              cpu: 500m
              ephemeral-storage: 50Mi
              memory: 512Mi
          volumeMounts:
            - name: empty-dir
              mountPath: /tmp
              subPath: tmp-dir
            - name: empty-dir
              mountPath: /opt/bitnami/mongodb/conf
              subPath: app-conf-dir
            - name: empty-dir
              mountPath: /opt/bitnami/mongodb/tmp
              subPath: app-tmp-dir
            - name: empty-dir
              mountPath: /opt/bitnami/mongodb/logs
              subPath: app-logs-dir
            - name: empty-dir
              mountPath: /bitnami/mongodb
              subPath: app-volume-dir
            - name: mongodb-secrets
              mountPath: /opt/bitnami/mongodb/secrets
      volumes:
        - name: empty-dir
          emptyDir: {}
        - name: mongodb-secrets
          secret:
            secretName: mongodb-auth
---
# Source: mongodb/templates/replicaset/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mongodb
  namespace: "mongodb"
  labels:
    app.kubernetes.io/instance: mongodb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: mongodb
    app.kubernetes.io/version: 8.3.2
    helm.sh/chart: mongodb-19.0.7
    app.kubernetes.io/component: mongodb
spec:
  serviceName: mongodb-headless
  podManagementPolicy: OrderedReady
  replicas: 2
  updateStrategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app.kubernetes.io/instance: mongodb
      app.kubernetes.io/name: mongodb
      app.kubernetes.io/component: mongodb
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: mongodb
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: mongodb
        app.kubernetes.io/version: 8.3.2
        helm.sh/chart: mongodb-19.0.7
        app.kubernetes.io/component: mongodb
    spec:

      serviceAccountName: mongodb
      automountServiceAccountToken: false
      affinity:
        podAffinity:

        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/instance: mongodb
                    app.kubernetes.io/name: mongodb
                    app.kubernetes.io/component: mongodb
                topologyKey: kubernetes.io/hostname
              weight: 1
        nodeAffinity:

      securityContext:
        fsGroup: 1001
        fsGroupChangePolicy: Always
        supplementalGroups: []
        sysctls: []

      enableServiceLinks: true
      initContainers:

        - name: log-dir
          image: registry-1.docker.io/bitnami/mongodb@sha256:594309a857f5254bc2ee6b5e538f680696f9c7e2bf20279ca3fec49f682de44e
          imagePullPolicy: "IfNotPresent"
          command:
            - /bin/bash
          args:
            - -ec
            - |
              ln -sf /dev/stdout "/opt/bitnami/mongodb/logs/mongodb.log"
          securityContext:
                    allowPrivilegeEscalation: false
                    capabilities:
                      drop:
                      - ALL
                    privileged: false
                    readOnlyRootFilesystem: true
                    runAsGroup: 1001
                    runAsNonRoot: true
                    runAsUser: 1001
                    seLinuxOptions: {}
                    seccompProfile:
                      type: RuntimeDefault
          resources:
                    limits:
                      cpu: 750m
                      ephemeral-storage: 2Gi
                      memory: 768Mi
                    requests:
                      cpu: 500m
                      ephemeral-storage: 50Mi
                      memory: 512Mi
          env:
            - name: OPENSSL_FIPS
              value: "yes"
          volumeMounts:
            - name: empty-dir
              mountPath: /opt/bitnami/mongodb/logs
              subPath: app-logs-dir
      containers:
        - name: mongodb
          image: registry-1.docker.io/bitnami/mongodb@sha256:594309a857f5254bc2ee6b5e538f680696f9c7e2bf20279ca3fec49f682de44e
          imagePullPolicy: "IfNotPresent"
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: true
            runAsGroup: 1001
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: {}
            seccompProfile:
              type: RuntimeDefault
          command:
            - /scripts/setup.sh
          env:
            - name: BITNAMI_DEBUG
              value: "false"
            - name: MY_POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: MY_POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: MY_POD_HOST_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            - name: MONGODB_INITIAL_PRIMARY_HOST
              value: "mongodb-0.mongodb-headless.$(MY_POD_NAMESPACE).svc.cluster.local"
            - name: MONGODB_REPLICA_SET_NAME
              value: "rs0"
            - name: OPENSSL_FIPS
              value: "yes"
            - name: MONGODB_ADVERTISED_HOSTNAME
              value: "$(MY_POD_NAME).mongodb-headless.$(MY_POD_NAMESPACE).svc.cluster.local"
            - name: MONGODB_ROOT_USER
              value: "root"
            - name: MONGODB_ROOT_PASSWORD_FILE
              value: "/opt/bitnami/mongodb/secrets/mongodb-root-password"
            - name: MONGODB_REPLICA_SET_KEY_FILE
              value: "/opt/bitnami/mongodb/secrets/mongodb-replica-set-key"
            - name: ALLOW_EMPTY_PASSWORD
              value: "no"
            - name: MONGODB_SYSTEM_LOG_VERBOSITY
              value: "0"
            - name: MONGODB_DISABLE_SYSTEM_LOG
              value: "no"
            - name: MONGODB_DISABLE_JAVASCRIPT
              value: "no"
            - name: MONGODB_ENABLE_JOURNAL
              value: "yes"
            - name: MONGODB_PORT_NUMBER
              value: "27017"
            - name: MONGODB_ENABLE_IPV6
              value: "no"
            - name: MONGODB_ENABLE_DIRECTORY_PER_DB
              value: "no"
          ports:
            - name: mongodb
              containerPort: 27017
          livenessProbe:
            failureThreshold: 6
            initialDelaySeconds: 30
            periodSeconds: 20
            successThreshold: 1
            timeoutSeconds: 10
            exec:
              command:
                - /bitnami/scripts/ping-mongodb.sh
          readinessProbe:
            failureThreshold: 6
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
            exec:
              command:
                - /bitnami/scripts/readiness-probe.sh
          resources:
            limits:
              cpu: 750m
              ephemeral-storage: 2Gi
              memory: 768Mi
            requests:
              cpu: 500m
              ephemeral-storage: 50Mi
              memory: 512Mi
          volumeMounts:
            - name: empty-dir
              mountPath: /tmp
              subPath: tmp-dir
            - name: empty-dir
              mountPath: /opt/bitnami/mongodb/conf
              subPath: app-conf-dir
            - name: empty-dir
              mountPath: /opt/bitnami/mongodb/tmp
              subPath: app-tmp-dir
            - name: empty-dir
              mountPath: /opt/bitnami/mongodb/logs
              subPath: app-logs-dir
            - name: empty-dir
              mountPath: /.mongodb
              subPath: mongosh-home
            - name: mongodb-secrets
              mountPath: /opt/bitnami/mongodb/secrets
            - name: datadir
              mountPath: /bitnami/mongodb
              subPath:
            - name: common-scripts
              mountPath: /bitnami/scripts
            - name: scripts
              mountPath: /scripts/setup.sh
              subPath: setup.sh

      volumes:
        - name: empty-dir
          emptyDir: {}
        - name: common-scripts
          configMap:
            name: mongodb-common-scripts
            defaultMode: 0550
        - name: mongodb-secrets
          secret:
            secretName: mongodb-auth
        - name: scripts
          configMap:
            name: mongodb-scripts
            defaultMode: 0755
  volumeClaimTemplates:
    - metadata:
        name: datadir
      spec:
        accessModes:
          - "ReadWriteOnce"
        resources:
          requests:
            storage: "8Gi"