apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Values.operator.name }}
  namespace: {{ .Release.Namespace }}
  {{- with .Values.additionalAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  labels:
    app: {{ .Values.operator.name }}
    name: {{ .Values.operator.name }}
    app.kubernetes.io/name: {{ .Values.operator.name }}
    {{- include "keda.labels" . | indent 4 }}
spec:
  revisionHistoryLimit: {{ .Values.operator.revisionHistoryLimit}}
  replicas: {{ .Values.operator.replicaCount}}
  {{- with .Values.upgradeStrategy.operator }}
  strategy:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  selector:
    matchLabels:
      app: {{ .Values.operator.name }}
  template:
    metadata:
      labels:
        app: {{ .Values.operator.name }}
        name: {{ .Values.operator.name }}
        app.kubernetes.io/name: {{ .Values.operator.name }}
        {{- include "keda.labels" . | indent 8 }}
        {{- if .Values.podLabels.keda }}
        {{- toYaml .Values.podLabels.keda | nindent 8 }}
        {{- end }}
        {{- if .Values.podIdentity.azureWorkload.enabled }}
        azure.workload.identity/use: "true"
        {{- end }}
      {{- if or .Values.podAnnotations.keda .Values.additionalAnnotations }}
      annotations:
        {{- if .Values.podAnnotations.keda }}
        {{- toYaml .Values.podAnnotations.keda | nindent 8 }}
        {{- end }}
        {{- if .Values.additionalAnnotations }}
        {{- toYaml .Values.additionalAnnotations | nindent 8 }}
        {{- end }}
      {{- end }}
    spec:
      enableServiceLinks: {{ .Values.enableServiceLinks }}
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName | quote }}
      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
      automountServiceAccountToken: {{ kindIs "invalid" (.Values.serviceAccount.operator).automountServiceAccountToken | ternary .Values.serviceAccount.automountServiceAccountToken (.Values.serviceAccount.operator).automountServiceAccountToken }}
      securityContext:
        {{- if .Values.podSecurityContext.operator }}
        {{- toYaml .Values.podSecurityContext.operator | nindent 8 }}
        {{- else }}
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
        {{- end }}
      containers:
        - name: {{ .Values.operator.name }}
          securityContext:
            {{- if .Values.securityContext.operator }}
            {{- toYaml .Values.securityContext.operator | nindent 12 }}
            {{- else }}
            {{- toYaml .Values.securityContext | nindent 12 }}
            {{- end }}
          {{- $registry := .Values.global.image.registry | default .Values.image.keda.registry | default "" }}
          {{- if $registry }}
          image: "{{ $registry }}/{{ .Values.image.keda.repository }}:{{ .Values.image.keda.tag | default .Chart.AppVersion }}"
          {{- else }}
          image: "{{ .Values.image.keda.repository }}:{{ .Values.image.keda.tag | default .Chart.AppVersion }}"
          {{- end }}
          command:
          - "/keda"
          args:
          - "--leader-elect"
          - "--disable-compression={{ .Values.operator.disableCompression}}"
          - "--zap-log-level={{ .Values.logging.operator.level }}"
          - "--zap-encoder={{ .Values.logging.operator.format }}"
          - "--zap-time-encoding={{ .Values.logging.operator.timeEncoding }}"
          - "--enable-webhook-patching={{ .Values.webhooks.enabled }}"
          {{- if .Values.logging.operator.stackTracesEnabled }}
          - "--zap-stacktrace-level=error"
          {{- end }}
          - "--cert-dir={{ .Values.certificates.mountPath }}"
          - "--enable-cert-rotation={{ and .Values.certificates.autoGenerated ( not .Values.certificates.certManager.enabled ) }}"          
          - "--cert-secret-name={{ .Values.certificates.secretName }}"
          - "--operator-service-name={{ .Values.operator.name }}"
          - "--metrics-server-service-name={{ .Values.operator.name }}-metrics-apiserver"
          - "--webhooks-service-name={{ .Values.webhooks.name }}"
          - "--k8s-cluster-name={{ tpl .Values.clusterName . }}"
          - "--k8s-cluster-domain={{ .Values.clusterDomain }}"
          - "--enable-prometheus-metrics={{ .Values.prometheus.operator.enabled }}"
          {{- if .Values.prometheus.operator.enabled }}
          - "--metrics-bind-address=:{{ .Values.prometheus.operator.port }}"
          {{- end }}
          {{- if .Values.opentelemetry.operator.enabled }}
          - "--enable-opentelemetry-metrics={{ .Values.opentelemetry.operator.enabled}}"
          {{- end }}
          {{- if .Values.profiling.operator.enabled }}
          - "--profiling-bind-address=:{{ .Values.profiling.operator.port }}"
          {{- end }}
          {{- with (.Values.certificates.operator).caDirs }}
          {{- range . }}
          - "--ca-dir={{ . }}"
          {{- end }}
          {{- end }}
          {{- range $key, $value := .Values.extraArgs.keda }}
          - "--{{ $key }}={{ $value }}"
          {{- end }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: {{ .Values.operator.livenessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.operator.livenessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.operator.livenessProbe.timeoutSeconds }}
            failureThreshold: {{ .Values.operator.livenessProbe.failureThreshold }}
            successThreshold: {{ .Values.operator.livenessProbe.successThreshold }}
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8081
            initialDelaySeconds: {{ .Values.operator.readinessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.operator.readinessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.operator.readinessProbe.timeoutSeconds }}
            failureThreshold: {{ .Values.operator.readinessProbe.failureThreshold }}
            successThreshold: {{ .Values.operator.readinessProbe.successThreshold }}
          ports:
          {{- if .Values.prometheus.operator.enabled }}
          - containerPort: {{ .Values.prometheus.operator.port }}
            name: metrics
            protocol: TCP
          {{- end }}
          - containerPort: 9666
            name: metricsservice
            protocol: TCP
          env:
            - name: WATCH_NAMESPACE
              value: {{ .Values.watchNamespace | quote }}
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: OPERATOR_NAME
              value: {{ .Values.operator.name }}
            - name: KEDA_HTTP_DEFAULT_TIMEOUT
              value: {{ .Values.http.timeout | quote }}
            - name: KEDA_HTTP_MIN_TLS_VERSION
              value: {{ .Values.http.minTlsVersion }}
            {{- if ( not .Values.http.keepAlive.enabled ) }}
            - name: KEDA_HTTP_DISABLE_KEEP_ALIVE
              value: "true"
            {{- end }}
            {{- if .Values.permissions.operator.restrict.secret }}
            - name: KEDA_RESTRICT_SECRET_ACCESS
              value: {{ .Values.permissions.operator.restrict.secret | quote }}
            {{- end }}
            {{- if .Values.opentelemetry.collector.uri }}
            - name: OTEL_EXPORTER_OTLP_ENDPOINT
              value: {{ .Values.opentelemetry.collector.uri | quote }}
            {{- end }}
            {{- if .Values.env }}
            {{- toYaml .Values.env | nindent 12 -}}
            {{- end }}
          volumeMounts:         
          - mountPath: {{ .Values.certificates.mountPath }}
            name: certificates
            readOnly: true
          {{- if .Values.grpcTLSCertsSecret }}
          - name: grpc-certs
            mountPath: /grpccerts
          {{- end }}
          {{- if .Values.hashiCorpVaultTLS }}
          - name: hashicorp-vault-certs
            mountPath: /hashicorp-vaultcerts
          {{- end }}
          {{- if .Values.volumes.keda.extraVolumeMounts }}
          {{- toYaml .Values.volumes.keda.extraVolumeMounts | nindent 10 }}
          {{- end }}
          resources:
            {{- if .Values.resources.operator }}
            {{- toYaml .Values.resources.operator | nindent 12 }}
            {{- else }}
            {{- toYaml .Values.resources | nindent 12 }}
            {{- end }}
        {{- if .Values.operator.extraContainers }}
        {{- toYaml .Values.operator.extraContainers | nindent 8 }}
        {{- end }}
      {{- if .Values.operator.extraInitContainers }}
      initContainers:
      {{- toYaml .Values.operator.extraInitContainers | nindent 8 }}
      {{- end }}
      volumes:
      - name: certificates
        secret:
          defaultMode: 420
          secretName: {{ .Values.certificates.secretName }}
          optional: {{ and .Values.certificates.autoGenerated ( not .Values.certificates.certManager.enabled ) }}
      {{- if .Values.grpcTLSCertsSecret }}
      - name: grpc-certs
        secret:
          secretName: {{ .Values.grpcTLSCertsSecret }}
      {{- end }}
      {{- if .Values.hashiCorpVaultTLS }}
      - name: hashicorp-vault-certs
        secret:
          secretName: {{ .Values.hashiCorpVaultTLS }}
      {{- end }}
      {{- if .Values.volumes.keda.extraVolumes }}
      {{- toYaml .Values.volumes.keda.extraVolumes | nindent 6 }}
      {{- end }}
      nodeSelector:
      {{- with .Values.nodeSelector }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- if .Values.podIdentity.gcp.enabled }}
        iam.gke.io/gke-metadata-server-enabled: "true"
      {{- end }}
      {{- if .Values.operator.affinity }}
      affinity:
        {{- toYaml .Values.operator.affinity | nindent 8 }}
      {{- else if .Values.affinity }}
      affinity:
        {{- toYaml .Values.affinity | nindent 8 }}
      {{- end }}
      {{- with .Values.topologySpreadConstraints.operator }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}