apiVersion: apps/v1
kind: Deployment
metadata:
  name: trino
  namespace: stonks-oracle
  labels:
    app: trino
    app.kubernetes.io/part-of: stonks-oracle
    stonks-oracle/tier: analytics
spec:
  replicas: 1
  selector:
    matchLabels:
      app: trino
  template:
    metadata:
      labels:
        app: trino
        stonks-oracle/tier: analytics
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: catalog-init
          image: busybox:1.36
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          command: ["sh", "-c"]
          args:
            - |
              cat > /catalog/iceberg.properties <<EOF
              connector.name=iceberg
              iceberg.catalog.type=hive_metastore
              hive.metastore.uri=thrift://hive-metastore.stonks-oracle.svc.cluster.local:9083
              fs.native-s3.enabled=true
              s3.endpoint=http://minio.minio-service.svc.cluster.local:80
              s3.path-style-access=true
              s3.region=us-east-1
              s3.aws-access-key=${MINIO_ACCESS_KEY}
              s3.aws-secret-key=${MINIO_SECRET_KEY}
              EOF
              cat > /catalog/lakehouse.properties <<EOF
              connector.name=hive
              hive.metastore.uri=thrift://hive-metastore.stonks-oracle.svc.cluster.local:9083
              fs.native-s3.enabled=true
              s3.endpoint=http://minio.minio-service.svc.cluster.local:80
              s3.path-style-access=true
              s3.region=us-east-1
              s3.aws-access-key=${MINIO_ACCESS_KEY}
              s3.aws-secret-key=${MINIO_SECRET_KEY}
              hive.non-managed-table-writes-enabled=true
              EOF
          env:
            - name: MINIO_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: stonks-core-secrets
                  key: MINIO_ACCESS_KEY
            - name: MINIO_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: stonks-core-secrets
                  key: MINIO_SECRET_KEY
          volumeMounts:
            - name: catalog-config
              mountPath: /catalog
      containers:
        - name: trino
          image: trinodb/trino:latest
          ports:
            - containerPort: 8080
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: catalog-config
              mountPath: /etc/trino/catalog
          resources:
            requests:
              cpu: 500m
              memory: 1Gi
            limits:
              cpu: "2"
              memory: 4Gi
          readinessProbe:
            httpGet:
              path: /v1/info
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 10
      volumes:
        - name: catalog-config
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: trino
  namespace: stonks-oracle
spec:
  selector:
    app: trino
  ports:
    - port: 8080
      targetPort: 8080