{{- $app := .Values }}
{{- $mode := $app.mode }}
{{- if and $mode (hasKey $app $mode) }}
{{- $modeOpts := index $app $mode }}
{{- $ctx := dict "helm" . }}
{{- $fullname := include "vm.plain.fullname" $ctx }}
{{- $ns := include "vm.namespace" $ctx }}
apiVersion: apps/v1
kind: {{ title $mode }}
metadata:
  name: {{ $fullname }}
  namespace: {{ $ns }}
  {{- $_ := set $ctx "extraLabels" $app.extraLabels }}
  labels: {{ include "vm.labels" $ctx | nindent 4 }}
  {{- $_ := unset $ctx "extraLabels" }}
  {{- with $app.annotations }}
  annotations: {{ toYaml . | nindent 4 }}
  {{- end }}
spec:
  {{- with $modeOpts.spec }}
  {{- toYaml . | nindent 2 }}
  {{- end }}
  {{- if ne $mode "daemonSet" }}
  replicas: {{ $app.replicaCount }}
  {{- end }}
  selector:
    matchLabels: {{ include "vm.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      {{- $_ := set $ctx "extraLabels" $app.podLabels }}
      labels: {{ include "vm.podLabels" $ctx | nindent 8 }}
      {{- $_ := unset $ctx "extraLabels" }}
      {{- $annotations := merge (dict "checksum/config" (include (print .Template.BasePath "/secret.yaml") . | sha256sum)) $app.podAnnotations }}
      annotations: {{ toYaml $annotations | nindent 8 }}
    spec:
      {{- with $app.priorityClassName }}
      priorityClassName: {{ . }}
      {{- end }}
      {{- with $app.schedulerName }}
      schedulerName: {{ . }}
      {{- end }}
      {{- if or (.Values.serviceAccount).name (.Values.serviceAccount).create }}
      serviceAccountName: {{ tpl ((.Values.serviceAccount).name | default $fullname) $ctx }}
      automountServiceAccountToken: {{ .Values.serviceAccount.automountToken }}
      {{- end }}
      {{- if $app.podSecurityContext.enabled }}
      securityContext: {{ include "vm.securityContext" (dict "securityContext" $app.podSecurityContext "helm" .) | nindent 8 }}
      {{- end }}
      {{- with ($app.imagePullSecrets | default "" (.Values.global).imagePullSecrets) }}
      imagePullSecrets: {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with $app.initContainers }}
      initContainers: {{ toYaml . | nindent 8 }}
      {{- end }}
      containers:
        - name: vmauth
          {{- if $app.securityContext.enabled }}
          securityContext: {{ include "vm.securityContext" (dict "securityContext" $app.securityContext "helm" .) | nindent 12 }}
          {{- end }}
          {{- $_ := set $ctx "app" $app }}
          image: {{ include "vm.image" $ctx }}
          imagePullPolicy: {{ $app.image.pullPolicy }}
          {{- if $app.containerWorkingDir }}
          workingDir: {{ $app.containerWorkingDir }}
          {{- end }}
          args: {{ include "vmauth.args" $ctx | nindent 12 }}
          {{- with $app.lifecycle }}
          lifecycle: {{ . | toYaml | nindent 12 }}
          {{- end }}
          ports:
            - name: http
              containerPort: {{ include "vm.port.from.flag" (dict "flag" $app.extraArgs.httpListenAddr "default" "8427") }}
          {{- with $app.envFrom }}
          envFrom: {{ toYaml . | nindent 12 }}
          {{- end }}
          {{- with $app.env }}
          env: {{ toYaml . | nindent 12 }}
          {{- end }}
          {{- with (fromYaml (include "vm.probe" (dict "app" $app "type" "readiness"))) }}
          readinessProbe: {{ toYaml . | nindent 12 }}
          {{- end }}
          {{- with (fromYaml (include "vm.probe" (dict "app" $app "type" "liveness"))) }}
          livenessProbe: {{ toYaml . | nindent 12 }}
          {{- end }}
          {{- with (fromYaml (include "vm.probe" (dict "app" $app "type" "startup"))) }}
          startupProbe: {{ toYaml . | nindent 12 }}
          {{- end }}
          volumeMounts:
            - name: config
              mountPath: /config
            {{- range $app.extraHostPathMounts }}
            - name: {{ .name }}
              mountPath: {{ .mountPath }}
              {{- with .subPath }}
              subPath: {{ . }}
              {{- end }}
              {{- with .readOnly }}
              readOnly: {{ . }}
              {{- end }}
            {{- end }}
            {{- with $app.extraVolumeMounts }}
            {{- toYaml . | nindent 12 }}
            {{- end }}
            {{- include "vm.license.mount" . | nindent 12 }}
          {{- with $app.resources }}
          resources: {{ toYaml . | nindent 12 }}
          {{- end }}
        {{- with $app.extraContainers }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      {{- with $app.nodeSelector }}
      nodeSelector: {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with $app.affinity }}
      affinity: {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with $app.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- range $constraint := . }}
        - {{ toYaml $constraint | nindent 10 | trim }}
          {{- if not $constraint.labelSelector }}
          labelSelector:
            matchLabels: {{ include "vm.selectorLabels" $ctx | nindent 14 }}
          {{- end }}
        {{- end }}
      {{- end }}
      {{- with $app.tolerations }}
      tolerations: {{ toYaml . | nindent 8 }}
      {{- end }}
      volumes:
        - name: config
          secret:
            secretName: {{ ternary $fullname $app.secretName (empty $app.secretName) }}
        {{- range $app.extraHostPathMounts }}
        - name: {{ .name }}
          hostPath:
            path: {{ .hostPath }}
        {{- end }}
        {{- with $app.extraVolumes }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- include "vm.license.volume" . | nindent 8 }}
{{- end }}