openshift.yaml

apiVersion: v1
kind: Template
metadata:
  name: saas-sentry
objects:
- apiVersion: v1
  kind: ConfigMap
  metadata:
    labels:
      service: sentry
    name: sentry
  data:
    sentry.conf.py: |-
      # This file is just Python, with a touch of Django which means
      # you can inherit and tweak settings to your hearts content.

      # For Docker, the following environment variables are supported:
      #  SENTRY_POSTGRES_HOST
      #  SENTRY_POSTGRES_PORT
      #  SENTRY_DB_NAME
      #  SENTRY_DB_USER
      #  SENTRY_DB_PASSWORD
      #  SENTRY_RABBITMQ_HOST
      #  SENTRY_RABBITMQ_USERNAME
      #  SENTRY_RABBITMQ_PASSWORD
      #  SENTRY_RABBITMQ_VHOST
      #  SENTRY_REDIS_HOST
      #  SENTRY_REDIS_PASSWORD
      #  SENTRY_REDIS_PORT
      #  SENTRY_REDIS_DB
      #  SENTRY_MEMCACHED_HOST
      #  SENTRY_MEMCACHED_PORT
      #  SENTRY_FILESTORE_DIR
      #  SENTRY_SERVER_EMAIL
      #  SENTRY_EMAIL_HOST
      #  SENTRY_EMAIL_PORT
      #  SENTRY_EMAIL_USER
      #  SENTRY_EMAIL_PASSWORD
      #  SENTRY_EMAIL_USE_TLS
      #  SENTRY_ENABLE_EMAIL_REPLIES
      #  SENTRY_SMTP_HOSTNAME
      #  SENTRY_MAILGUN_API_KEY
      #  SENTRY_SINGLE_ORGANIZATION
      #  SENTRY_SECRET_KEY
      #  GITHUB_APP_ID
      #  GITHUB_API_SECRET
      #  BITBUCKET_CONSUMER_KEY
      #  BITBUCKET_CONSUMER_SECRET
      from sentry.conf.server import *  # NOQA

      import os
      import os.path

      CONF_ROOT = os.path.dirname(__file__)

      postgres = env('SENTRY_POSTGRES_HOST') or (env('POSTGRES_PORT_5432_TCP_ADDR') and 'postgres')
      if postgres:
          DATABASES = {
              'default': {
                  'ENGINE': 'sentry.db.postgres',
                  'NAME': (
                      env('SENTRY_DB_NAME')
                      or env('POSTGRES_ENV_POSTGRES_USER')
                      or 'postgres'
                  ),
                  'USER': (
                      env('SENTRY_DB_USER')
                      or env('POSTGRES_ENV_POSTGRES_USER')
                      or 'postgres'
                  ),
                  'PASSWORD': (
                      env('SENTRY_DB_PASSWORD')
                      or env('POSTGRES_ENV_POSTGRES_PASSWORD')
                      or ''
                  ),
                  'HOST': postgres,
                  'PORT': (
                      env('SENTRY_POSTGRES_PORT')
                      or ''
                  ),
                  'OPTIONS': {
                      'autocommit': True,
                  },
              },
          }

      # You should not change this setting after your database has been created
      # unless you have altered all schemas first
      SENTRY_USE_BIG_INTS = True

      # If you're expecting any kind of real traffic on Sentry, we highly recommend
      # configuring the CACHES and Redis settings

      ###########
      # General #
      ###########

      # Instruct Sentry that this install intends to be run by a single organization
      # and thus various UI optimizations should be enabled.
      SENTRY_SINGLE_ORGANIZATION = env('SENTRY_SINGLE_ORGANIZATION', True)

      #########
      # Redis #
      #########

      # Generic Redis configuration used as defaults for various things including:
      # Buffers, Quotas, TSDB

      redis = env('SENTRY_REDIS_HOST') or (env('REDIS_PORT_6379_TCP_ADDR') and 'redis')
      if not redis:
          raise Exception('Error: REDIS_PORT_6379_TCP_ADDR (or SENTRY_REDIS_HOST) is undefined, did you forget to `--link` a redis container?')

      redis_password = env('SENTRY_REDIS_PASSWORD') or ''
      redis_port = env('SENTRY_REDIS_PORT') or '6379'
      redis_db = env('SENTRY_REDIS_DB') or '0'

      SENTRY_OPTIONS.update({
          'redis.clusters': {
              'default': {
                  'hosts': {
                      0: {
                          'host': redis,
                          'password': redis_password,
                          'port': redis_port,
                          'db': redis_db,
                      },
                  },
              },
          },
      })

      #########
      # Cache #
      #########

      # Sentry currently utilizes two separate mechanisms. While CACHES is not a
      # requirement, it will optimize several high throughput patterns.

      memcached = env('SENTRY_MEMCACHED_HOST') or (env('MEMCACHED_PORT_11211_TCP_ADDR') and 'memcached')
      if memcached:
          memcached_port = (
              env('SENTRY_MEMCACHED_PORT')
              or '11211'
          )
          CACHES = {
              'default': {
                  'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
                  'LOCATION': [memcached + ':' + memcached_port],
                  'TIMEOUT': 3600,
              }
          }

      # A primary cache is required for things such as processing events
      SENTRY_CACHE = 'sentry.cache.redis.RedisCache'

      #########
      # Queue #
      #########

      # See https://docs.getsentry.com/on-premise/server/queue/ for more
      # information on configuring your queue broker and workers. Sentry relies
      # on a Python framework called Celery to manage queues.

      rabbitmq = env('SENTRY_RABBITMQ_HOST') or (env('RABBITMQ_PORT_5672_TCP_ADDR') and 'rabbitmq')

      if rabbitmq:
          BROKER_URL = (
              'amqp://' + (
                  env('SENTRY_RABBITMQ_USERNAME')
                  or env('RABBITMQ_ENV_RABBITMQ_DEFAULT_USER')
                  or 'guest'
              ) + ':' + (
                  env('SENTRY_RABBITMQ_PASSWORD')
                  or env('RABBITMQ_ENV_RABBITMQ_DEFAULT_PASS')
                  or 'guest'
              ) + '@' + rabbitmq + '/' + (
                  env('SENTRY_RABBITMQ_VHOST')
                  or env('RABBITMQ_ENV_RABBITMQ_DEFAULT_VHOST')
                  or '/'
              )
          )
      else:
          BROKER_URL = 'redis://:' + redis_password + '@' + redis + ':' + redis_port + '/' + redis_db


      ###############
      # Rate Limits #
      ###############

      # Rate limits apply to notification handlers and are enforced per-project
      # automatically.

      SENTRY_RATELIMITER = 'sentry.ratelimits.redis.RedisRateLimiter'

      ##################
      # Update Buffers #
      ##################

      # Buffers (combined with queueing) act as an intermediate layer between the
      # database and the storage API. They will greatly improve efficiency on large
      # numbers of the same events being sent to the API in a short amount of time.
      # (read: if you send any kind of real data to Sentry, you should enable buffers)

      SENTRY_BUFFER = 'sentry.buffer.redis.RedisBuffer'

      ##########
      # Quotas #
      ##########

      # Quotas allow you to rate limit individual projects or the Sentry install as
      # a whole.

      SENTRY_QUOTAS = 'sentry.quotas.redis.RedisQuota'

      ########
      # TSDB #
      ########

      # The TSDB is used for building charts as well as making things like per-rate
      # alerts possible.

      SENTRY_TSDB = 'sentry.tsdb.redis.RedisTSDB'

      ###########
      # Digests #
      ###########

      # The digest backend powers notification summaries.

      SENTRY_DIGESTS = 'sentry.digests.backends.redis.RedisBackend'

      ################
      # File storage #
      ################

      # Uploaded media uses these `filestore` settings. The available
      # backends are either `filesystem` or `s3`.

      filestorehost = env('SENTRY_FILE_HOST')
      if filestorehost:
           SENTRY_OPTIONS['filestore.backend'] = 's3'
           SENTRY_OPTIONS['filestore.options'] = {
               'access_key': env('SENTRY_FILE_ACCESS'),
               'secret_key': env('SENTRY_FILE_SECRET'),
               'bucket_name': env('SENTRY_FILE_BUCKET'),
               'endpoint_url': filestorehost
           }

      filestoredir = env('SENTRY_FILESTORE_DIR')
      if filestoredir and not filestorehost:
           SENTRY_OPTIONS['filestore.backend'] = 'filesystem'
           SENTRY_OPTIONS['filestore.options'] = {
               'location': filestoredir
           }

      ##############
      # Web Server #
      ##############

      # If you're using a reverse SSL proxy, you should enable the X-Forwarded-Proto
      # header and set `SENTRY_USE_SSL=1`

      if env('SENTRY_USE_SSL', False):
          SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
          SESSION_COOKIE_SECURE = True
          CSRF_COOKIE_SECURE = True
          SOCIAL_AUTH_REDIRECT_IS_HTTPS = True

      SENTRY_WEB_HOST = '0.0.0.0'
      SENTRY_WEB_PORT = 9000
      SENTRY_WEB_OPTIONS = {
          # 'workers': 3,  # the number of web workers
      }

      ghappid = env('GITHUB_APP_ID')
      ghapisecret = env('GITHUB_API_SECRET')

      if ghappid:
           GITHUB_APP_ID = ghappid

      if ghapisecret:
           GITHUB_API_SECRET = ghapisecret

      if ghappid and ghapisecret:
           GITHUB_EXTENDED_PERMISSIONS = ['repo']

      ###############
      # Mail Server #
      ###############


      email = env('SENTRY_EMAIL_HOST') or (env('SMTP_PORT_25_TCP_ADDR') and 'smtp')
      if email:
          SENTRY_OPTIONS['mail.backend'] = 'smtp'
          SENTRY_OPTIONS['mail.host'] = email
          SENTRY_OPTIONS['mail.password'] = env('SENTRY_EMAIL_PASSWORD') or ''
          SENTRY_OPTIONS['mail.username'] = env('SENTRY_EMAIL_USER') or ''
          SENTRY_OPTIONS['mail.port'] = int(env('SENTRY_EMAIL_PORT') or 25)
          SENTRY_OPTIONS['mail.use-tls'] = env('SENTRY_EMAIL_USE_TLS', False)
      else:
          SENTRY_OPTIONS['mail.backend'] = 'console'

      # The email address to send on behalf of
      SENTRY_OPTIONS['mail.from'] = env('SENTRY_SERVER_EMAIL') or 'devops@company.com'

      # If you're using mailgun for inbound mail, set your API key and configure a
      # route to forward to /api/hooks/mailgun/inbound/
      SENTRY_OPTIONS['mail.mailgun-api-key'] = env('SENTRY_MAILGUN_API_KEY') or ''

      # If you specify a MAILGUN_API_KEY, you definitely want EMAIL_REPLIES
      if SENTRY_OPTIONS['mail.mailgun-api-key']:
          SENTRY_OPTIONS['mail.enable-replies'] = True
      else:
          SENTRY_OPTIONS['mail.enable-replies'] = env('SENTRY_ENABLE_EMAIL_REPLIES', False)

      if SENTRY_OPTIONS['mail.enable-replies']:
          SENTRY_OPTIONS['mail.reply-hostname'] = env('SENTRY_SMTP_HOSTNAME') or ''

      # If this value ever becomes compromised, it's important to regenerate your
      # SENTRY_SECRET_KEY. Changing this value will result in all current sessions
      # being invalidated.
      secret_key = env('SENTRY_SECRET_KEY')
      if not secret_key:
          raise Exception('Error: SENTRY_SECRET_KEY is undefined, run `generate-secret-key` and set to -e SENTRY_SECRET_KEY')

      if 'SENTRY_RUNNING_UWSGI' not in os.environ and len(secret_key) < 32:
          print('!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!')
          print('!!                    CAUTION                       !!')
          print('!! Your SENTRY_SECRET_KEY is potentially insecure.  !!')
          print('!!    We recommend at least 32 characters long.     !!')
          print('!!     Regenerate with `generate-secret-key`.       !!')
          print('!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!')

      SENTRY_OPTIONS['system.secret-key'] = secret_key


      if 'BITBUCKET_CONSUMER_KEY' in os.environ:
          BITBUCKET_CONSUMER_KEY = env('BITBUCKET_CONSUMER_KEY')
          BITBUCKET_CONSUMER_SECRET = env('BITBUCKET_CONSUMER_SECRET')
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: redis-data
  spec:
    accessModes:
    - ReadWriteOnce
    resources:
      requests:
        storage: 1Gi
- apiVersion: v1
  kind: DeploymentConfig
  metadata:
    generation: 1
    labels:
      run: redis
      service: sentry
    name: redis
  spec:
    replicas: 1
    selector:
      run: redis
    strategy:
      activeDeadlineSeconds: 21600
      resources: {}
      rollingParams:
        intervalSeconds: 1
        maxSurge: 25%
        maxUnavailable: 25%
        timeoutSeconds: 600
        updatePeriodSeconds: 1
      type: Rolling
    template:
      metadata:
        labels:
          run: redis
      spec:
        containers:
        - image: registry.centos.org/centos/redis-32-centos7:latest
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: 6379
            timeoutSeconds: 1
          name: redis
          ports:
          - containerPort: 6379
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: 6379
            timeoutSeconds: 1
          resources: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /var/lib/redis/data/
            name: redis-data
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        terminationGracePeriodSeconds: 30
        volumes:
        - name: redis-data
          persistentVolumeClaim:
            claimName: redis-data
    test: false
    triggers:
    - type: ConfigChange
  status:
    availableReplicas: 0
    latestVersion: 0
    observedGeneration: 0
    replicas: 0
    unavailableReplicas: 0
    updatedReplicas: 0
- apiVersion: v1
  kind: DeploymentConfig
  metadata:
    generation: 1
    labels:
      run: sentry-cron
      service: sentry
    name: sentry-cron
  spec:
    replicas: 1
    selector:
      run: sentry-cron
    strategy:
      activeDeadlineSeconds: 21600
      resources: {}
      rollingParams:
        intervalSeconds: 1
        maxSurge: 25%
        maxUnavailable: 25%
        timeoutSeconds: 600
        updatePeriodSeconds: 1
      type: Rolling
    template:
      metadata:
        labels:
          run: sentry-cron
      spec:
        containers:
        - command:
          - sentry
          - run
          - cron
          env:
          - name: SENTRY_POSTGRES_HOST
            valueFrom:
               secretKeyRef:
                 name: sentry-db
                 key: POSTGRESQL_HOSTNAME
          envFrom:
           - secretRef:
               name: sentry-general
           - secretRef:
               name: sentry-github-oauth
           - secretRef:
               name: sentry-s3
          image: registry.centos.org/centos/sentry-sso:8.22
          imagePullPolicy: Always
          name: sentry-cron
          resources: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /etc/sentry/
            name: config-volume
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        terminationGracePeriodSeconds: 30
        volumes:
        - configMap:
            defaultMode: 420
            name: sentry
          name: config-volume
    test: false
    triggers:
    - type: ConfigChange
  status:
    availableReplicas: 0
    latestVersion: 0
    observedGeneration: 0
    replicas: 0
    unavailableReplicas: 0
    updatedReplicas: 0
- apiVersion: v1
  kind: DeploymentConfig
  metadata:
    generation: 1
    labels:
      run: sentry-web
      service: sentry
    name: sentry-web
  spec:
    replicas: 2
    selector:
      run: sentry-web
    strategy:
      activeDeadlineSeconds: 21600
      resources: {}
      rollingParams:
        intervalSeconds: 1
        maxSurge: 25%
        maxUnavailable: 25%
        timeoutSeconds: 600
        updatePeriodSeconds: 1
      type: Rolling
    template:
      metadata:
        labels:
          run: sentry-web
      spec:
        containers:
        - env:
          - name: SENTRY_POSTGRES_HOST
            valueFrom:
              secretKeyRef:
                name: sentry-db
                key: POSTGRESQL_HOSTNAME
          - name: SENTRY_USE_SSL
            value: "true"
          envFrom:
           - secretRef:
               name: sentry-general
           - secretRef:
               name: sentry-github-oauth
           - secretRef:
               name: sentry-s3
          image: registry.centos.org/centos/sentry-sso:8.22
          imagePullPolicy: Always
          name: sentry-web
          ports:
          - containerPort: 9000
            protocol: TCP
          resources: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /etc/sentry/
            name: config-volume
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        terminationGracePeriodSeconds: 30
        volumes:
        - configMap:
            defaultMode: 420
            name: sentry
          name: config-volume
    test: false
    triggers:
    - type: ConfigChange
  status:
    availableReplicas: 0
    latestVersion: 0
    observedGeneration: 0
    replicas: 0
    unavailableReplicas: 0
    updatedReplicas: 0
- apiVersion: v1
  kind: DeploymentConfig
  metadata:
    generation: 1
    labels:
      run: sentry-worker
      service: sentry
    name: sentry-worker
  spec:
    replicas: 1
    selector:
      run: sentry-worker
    strategy:
      activeDeadlineSeconds: 21600
      resources: {}
      rollingParams:
        intervalSeconds: 1
        maxSurge: 25%
        maxUnavailable: 25%
        timeoutSeconds: 600
        updatePeriodSeconds: 1
      type: Rolling
    template:
      metadata:
        labels:
          run: sentry-worker
      spec:
        containers:
        - command:
          - sentry
          - run
          - worker
          env:
          - name: SENTRY_POSTGRES_HOST
            valueFrom:
              secretKeyRef:
                name: sentry-db
                key: POSTGRESQL_HOSTNAME
          - name: C_FORCE_ROOT
            value: "TRUE"
          envFrom:
           - secretRef:
               name: sentry-general
           - secretRef:
               name: sentry-github-oauth
           - secretRef:
               name: sentry-s3
          image: registry.centos.org/centos/sentry-sso:8.22
          imagePullPolicy: Always
          name: sentry-worker
          resources: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /etc/sentry/
            name: config-volume
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        terminationGracePeriodSeconds: 30
        volumes:
        - configMap:
            defaultMode: 420
            name: sentry
          name: config-volume
    test: false
    triggers:
    - type: ConfigChange
  status:
    availableReplicas: 0
    latestVersion: 0
    observedGeneration: 0
    replicas: 0
    unavailableReplicas: 0
    updatedReplicas: 0
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      run: redis
      service: sentry
    name: redis
  spec:
    ports:
    - port: 6379
      protocol: TCP
      targetPort: 6379
    selector:
      run: redis
    sessionAffinity: None
    type: ClusterIP
  status:
    loadBalancer: {}
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      run: sentry
      service: sentry
    name: sentry
  spec:
    ports:
    - name: http
      port: 9000
      protocol: TCP
      targetPort: 9000
    selector:
      run: sentry-web
    sessionAffinity: None
    type: ClusterIP
  status:
    loadBalancer: {}
parameters:
- description: Image tag
  displayName: Image tag
  name: IMAGE_TAG
  value: "latest"