# Copyright 2017 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

{{- include "kubernetes-dashboard.validate.mode" $ -}}
{{- if eq .Values.app.mode "dashboard" }}

kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    {{- include "kubernetes-dashboard.labels" . | nindent 4 }}
    {{- with .Values.auth.labels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
    app.kubernetes.io/name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.auth.role }}
    app.kubernetes.io/version: {{ .Values.api.image.tag }}
    app.kubernetes.io/component: {{ .Values.auth.role }}
  annotations:
    {{- include "kubernetes-dashboard.annotations" . | nindent 4 }}
    {{- with .Values.auth.annotations }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  name: {{ template "kubernetes-dashboard.fullname" . }}-{{ .Values.auth.role }}
spec:
  replicas: {{ .Values.auth.scaling.replicas }}
  revisionHistoryLimit: {{ .Values.auth.scaling.revisionHistoryLimit }}
  selector:
    matchLabels:
      {{- include "kubernetes-dashboard.matchLabels" . | nindent 6 }}
      app.kubernetes.io/name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.auth.role }}
  template:
    metadata:
      labels:
        {{- include "kubernetes-dashboard.labels" . | nindent 8 }}
        {{- with .Values.auth.labels }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
        app.kubernetes.io/name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.auth.role }}
        app.kubernetes.io/version: {{ .Values.auth.image.tag }}
        app.kubernetes.io/component: {{ .Values.auth.role }}
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/secrets/csrf.yaml") . | sha256sum }}
        {{- with .Values.auth.annotations }}
        {{ toYaml . | nindent 8 }}
        {{- end }}
    spec:
      containers:
        - name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.auth.role }}
          image: "{{ .Values.auth.image.repository }}:{{ .Values.auth.image.tag }}"
          imagePullPolicy: {{ .Values.app.image.pullPolicy }}
          args:
          {{- with .Values.auth.containers.args }}
          {{ toYaml . | nindent 12 }}
          {{- end }}

          env:
            - name: CSRF_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ template "kubernetes-dashboard.app.csrf.secret.name" . }}
                  key: {{ template "kubernetes-dashboard.app.csrf.secret.key" . }}

            {{- if .Values.auth.containers.resources.limits.cpu }}
            - name: GOMAXPROCS
              valueFrom:
                resourceFieldRef:
                  resource: limits.cpu
                  divisor: "1"
            {{- end }}
            {{- if .Values.auth.containers.resources.limits.memory }}
            - name: GOMEMLIMIT
              valueFrom:
                resourceFieldRef:
                  resource: limits.memory
                  divisor: "1"
            {{- end }}

          {{- with .Values.auth.containers.env }}
          {{ toYaml . | nindent 12 }}
          {{- end }}

          {{- with .Values.auth.containers.ports }}
          ports:
          {{ toYaml . | nindent 12 }}
          {{- end }}

          {{- with .Values.auth.containers.volumeMounts }}
          volumeMounts:
          {{ toYaml . | nindent 12 }}
          {{- end }}

          {{- with .Values.app.security.containerSecurityContext }}
          securityContext:
          {{ toYaml . | nindent 12 }}
          {{- end }}

          {{- with .Values.auth.containers.resources }}
          resources:
          {{ toYaml . | nindent 12 }}
          {{- end }}

      {{- with .Values.app.image.pullSecrets }}
      imagePullSecrets:
      {{- range . }}
        - name: {{ . }}
      {{- end }}
      {{- end }}

      automountServiceAccountToken: {{ .Values.auth.automountServiceAccountToken }}

      {{- with .Values.app.security.securityContext }}
      securityContext:
      {{ toYaml . | nindent 8 }}
      {{- end }}

      {{- with .Values.auth.volumes }}
      volumes:
      {{ toYaml . | nindent 8 }}
      {{- end }}

      {{- with .Values.app.priorityClassName }}
      priorityClassName: {{ . }}
      {{- end }}

      {{- if or .Values.auth.nodeSelector .Values.app.scheduling.nodeSelector }}
      nodeSelector:
      {{- with .Values.auth.nodeSelector }}
      {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.app.scheduling.nodeSelector }}
      {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- end }}

      {{- with .Values.app.tolerations }}
      tolerations:
      {{ toYaml . | nindent 8 }}
      {{- end }}

      {{- with .Values.app.affinity }}
      affinity:
      {{ toYaml . | nindent 8 }}
      {{- end }}

{{- end }}