apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "fullname" . }}
  labels:
    {{- include "athens.metaLabels" . | nindent 4 }}
spec:
  {{- if not .Values.autoscaling.enabled }}
  replicas: {{ .Values.replicaCount }}
  {{- end }}
  {{- with .Values.strategy }}
  strategy:
    {{- if eq .type "Recreate" }}
    type: Recreate
    {{- else }}
    {{ toYaml . | nindent 4 }}
    {{- end }}
  {{- end }}
  selector:
    matchLabels:
      app: {{ include "fullname" . }}
      release: "{{ .Release.Name }}"
  template:
    metadata:
      labels:
        {{- include "athens.metaLabels" . | nindent 8 }}
      annotations:
        checksum/upstream: {{ include (print $.Template.BasePath "/config-upstream.yaml") . | sha256sum }}
        checksum/ssh-config: {{ include (print $.Template.BasePath "/config-ssh-git-servers.yaml") . | sha256sum }}
        checksum/ssh-secret: {{ include (print $.Template.BasePath "/secret-ssh-git-servers.yaml") . | sha256sum }}
        {{- if .Values.annotations }}
        {{- toYaml .Values.annotations | nindent 8 }}
        {{- end }}
    spec:
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName | quote }}
      {{- end }}
      {{- if .Values.terminationGracePeriodSeconds }}
      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
      {{- end }}
      {{- if .Values.image.runAsNonRoot }}
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
      {{- end }}
      serviceAccountName: {{ include "serviceAccountName" . | quote }}
      {{- if .Values.image.pullSecrets }}
      imagePullSecrets:
        {{- toYaml .Values.image.pullSecrets | nindent 8 }}
      {{- end }}
      {{- if or .Values.sshGitServers .Values.extraInitContainers }}
      initContainers:
      {{- if .Values.sshGitServers }}
        - name: copy-key-files
          image: alpine:3.9
          command:
            - sh
            - -c
          args: ["cp {{ include "home" . }}/.ssh/id_rsa* /ssh-keys && chmod 400 /ssh-keys/*"]
          volumeMounts:
          - name: ssh-keys
            mountPath: /ssh-keys
          {{- $dot := . -}}
          {{- range $server := .Values.sshGitServers }}
          {{- if $server.existingSecret }}
          - name: ssh-git-servers-secret-{{ $server.host | replace "." "-" }}
            mountPath: "{{ include "home" $dot }}/.ssh/id_rsa-{{ $server.host }}"
            subPath: {{ $server.existingSecret.subPath | quote }}
          {{- else }}
          - name: ssh-git-servers-secret
            mountPath: {{ include "home" $dot }}/.ssh/id_rsa-{{ $server.host }}
            subPath: id_rsa-{{ $server.host }}
          {{- end }}
          {{- end }}
          {{- with .Values.initContainerSecurityContext }}
          securityContext:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with (default .Values.intiContainerResources .Values.initContainerResources) }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
      {{- end }}
      {{- if .Values.extraInitContainers }}
        {{- toYaml .Values.extraInitContainers | nindent 6 }}
      {{- end }}
      {{- end }}
      containers:
      - name: {{ include "fullname" . }}
        image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
        imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
        livenessProbe:
          failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
          httpGet:
            path: "/healthz"
            port: 3000
          periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
          successThreshold: {{ .Values.livenessProbe.successThreshold }}
          timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
        readinessProbe:
          failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
          httpGet:
            path: "/readyz"
            port: 3000
          periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
          successThreshold: {{ .Values.readinessProbe.successThreshold }}
          timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
        env:
        - name: ATHENS_GOGET_WORKERS
          value: {{ .Values.goGetWorkers | quote }}
        - name: ATHENS_STORAGE_TYPE
          value: {{ .Values.storage.type | quote }}
{{- if eq .Values.storage.type "disk"}}
        - name: ATHENS_DISK_STORAGE_ROOT
          value: {{ .Values.storage.disk.storageRoot | quote }}
{{- else if eq .Values.storage.type "mongo"}}
        - name: ATHENS_MONGO_STORAGE_URL
          valueFrom:
            secretKeyRef:
              name: {{ include "fullname" . }}-secret
              key: ATHENS_MONGO_STORAGE_URL
{{- else if eq .Values.storage.type "s3" }}
        - name: AWS_REGION
          value: {{ .Values.storage.s3.region | quote }}
        - name: ATHENS_S3_BUCKET_NAME
          value: {{ .Values.storage.s3.bucket | quote }}
        - name: AWS_USE_DEFAULT_CONFIGURATION
          value: {{ .Values.storage.s3.useDefaultConfiguration | quote }}
        - name: AWS_FORCE_PATH_STYLE
          value: {{ .Values.storage.s3.forcePathStyle | quote }}
        {{- if .Values.storage.s3.accessKey }}
        - name: AWS_ACCESS_KEY_ID
          valueFrom:
            secretKeyRef:
              name: {{ include "fullname" . }}-secret
              key: AWS_ACCESS_KEY_ID
        {{- end }}
        {{- if .Values.storage.s3.secretKey }}
        - name: AWS_SECRET_ACCESS_KEY
          valueFrom:
            secretKeyRef:
              name: {{ include "fullname" . }}-secret
              key: AWS_SECRET_ACCESS_KEY
        {{- end }}
        {{- if .Values.storage.s3.sessionToken }}
        - name: AWS_SESSION_TOKEN
          valueFrom:
            secretKeyRef:
              name: {{ include "fullname" . }}-secret
              key: AWS_SESSION_TOKEN
        {{- end }}
{{- else if eq .Values.storage.type "gcp"}}
        - name: GOOGLE_CLOUD_PROJECT
          value: {{ .Values.storage.gcp.projectID | quote }}
        - name: ATHENS_STORAGE_GCP_BUCKET
          value: {{ .Values.storage.gcp.bucket | quote }}
        {{- if .Values.storage.gcp.serviceAccount }}
        - name: ATHENS_STORAGE_GCP_JSON_KEY
          valueFrom:
            secretKeyRef:
              name: {{ include "fullname" . }}-secret
              key: ATHENS_STORAGE_GCP_JSON_KEY
        {{- end }}
{{- else if eq .Values.storage.type "minio" }}
        {{- if .Values.storage.minio.endpoint }}
        - name: ATHENS_MINIO_ENDPOINT
          value: {{ .Values.storage.minio.endpoint | quote }}
        {{- end }}
        {{- if .Values.storage.minio.accessKey }}
        - name: ATHENS_MINIO_ACCESS_KEY_ID
          valueFrom:
            secretKeyRef:
              name: {{ include "fullname" . }}-secret
              key: ATHENS_MINIO_ACCESS_KEY_ID
        {{- end }}
        {{- if .Values.storage.minio.secretKey }}
        - name: ATHENS_MINIO_SECRET_ACCESS_KEY
          valueFrom:
            secretKeyRef:
              name: {{ include "fullname" . }}-secret
              key: ATHENS_MINIO_SECRET_ACCESS_KEY
        {{- end }}
        {{- if .Values.storage.minio.bucket }}
        - name: ATHENS_MINIO_BUCKET_NAME
          value: {{ .Values.storage.minio.bucket | quote }}
        {{- end }}
{{- end }}
        {{- if .Values.singleFlight.type }}
        - name: ATHENS_SINGLE_FLIGHT_TYPE
          value: {{ .Values.singleFlight.type | quote }}
        {{- end }}
{{- if eq .Values.singleFlight.type "etcd"}}
        {{- if .Values.singleFlight.etcd.endpoints }}
        - name: ATHENS_ETCD_ENDPOINTS
          value: {{ .Values.singleFlight.etcd.endpoints | quote }}
        {{- end }}
{{- else if eq .Values.singleFlight.type "redis"}}
        {{- if .Values.singleFlight.redis.endpoint }}
        - name: ATHENS_REDIS_ENDPOINT
          value: {{ .Values.singleFlight.redis.endpoint | quote }}
        {{- end }}
        {{- if .Values.singleFlight.redis.password }}
        - name: ATHENS_REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ include "fullname" . }}-secret
              key: ATHENS_SINGLE_FLIGHT_REDIS_PASSWORD
        {{- end }}
        {{- with .Values.singleFlight.redis.lockConfig }}
        {{- if .ttl }}
        - name: ATHENS_REDIS_LOCK_TTL
          value: {{ .ttl | quote }}
        {{- end }}
        {{- if .timeout }}
        - name: ATHENS_REDIS_LOCK_TIMEOUT
          value: {{ .timeout | quote }}
        {{- end }}
        {{- if .maxRetries }}
        - name: ATHENS_REDIS_LOCK_MAX_RETRIES
          value: {{ .maxRetries | quote }}
        {{- end }}
        {{- end }}
{{- else if eq .Values.singleFlight.type "redis-sentinel"}}
        {{- if .Values.singleFlight.redisSentinel.endpoints }}
        - name: ATHENS_REDIS_SENTINEL_ENDPOINTS
          value: {{ .Values.singleFlight.redisSentinel.endpoints | quote }}
        {{- end }}
        {{- if .Values.singleFlight.redisSentinel.masterName }}
        - name: ATHENS_REDIS_SENTINEL_MASTER_NAME
          value: {{ .Values.singleFlight.redisSentinel.masterName | quote }}
        {{- end }}
        {{- if .Values.singleFlight.redisSentinel.sentinelPassword }}
        - name: ATHENS_REDIS_SENTINEL_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ include "fullname" . }}-secret
              key: ATHENS_SINGLE_FLIGHT_REDIS_SENTINEL_SENTINEL_PASSWORD
        {{- end }}
        {{- if .Values.singleFlight.redisSentinel.redisUsername }}
        - name: ATHENS_REDIS_USERNAME
          value: {{ .Values.singleFlight.redisSentinel.redisUsername | quote }}
        {{- end }}
        {{- if .Values.singleFlight.redisSentinel.redisPassword }}
        - name: ATHENS_REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ include "fullname" . }}-secret
              key: ATHENS_SINGLE_FLIGHT_REDIS_SENTINEL_REDIS_PASSWORD
        {{- end }}
        {{- with .Values.singleFlight.redisSentinel.lockConfig }}
        {{- if .ttl }}
        - name: ATHENS_REDIS_LOCK_TTL
          value: {{ .ttl | quote }}
        {{- end }}
        {{- if .timeout }}
        - name: ATHENS_REDIS_LOCK_TIMEOUT
          value: {{ .timeout | quote }}
        {{- end }}
        {{- if .maxRetries }}
        - name: ATHENS_REDIS_LOCK_MAX_RETRIES
          value: {{ .maxRetries | quote }}
        {{- end }}
        {{- end }}
{{- end }}
        {{- if .Values.netrc.enabled }}
        - name: ATHENS_NETRC_PATH
          value: "/etc/netrc/.netrc"
        {{- end }}
        {{- if .Values.upstreamProxy.enabled }}
        - name: ATHENS_FILTER_FILE
          value: "/usr/local/lib/FilterForUpstreamProxy"
        - name: ATHENS_GLOBAL_ENDPOINT
          value: {{ .Values.upstreamProxy.url | quote }}
        {{- end }}
        {{- if .Values.jaeger.enabled }}
        - name: ATHENS_TRACE_EXPORTER_URL
          value: {{ .Values.jaeger.url | default (print "http://" (include "fullname" .) "-jaeger:14268" ) | quote }}
        - name: ATHENS_TRACE_EXPORTER
          value: "jaeger"
        {{- end }}
        {{- if and .Values.tracing.enabled (not .Values.jaeger.enabled) }}
        - name: ATHENS_TRACE_EXPORTER_URL
          value: {{ .Values.tracing.url }}
        - name: ATHENS_TRACE_EXPORTER
          value: {{ .Values.tracing.type }}
        {{- end }}
        {{- if .Values.basicAuth.enabled }}
        - name: BASIC_AUTH_USER
          valueFrom:
            secretKeyRef:
              name: {{ default "athens-proxy-basic-auth" .Values.basicAuth.secretName | quote }}
              key: {{ default "username" .Values.basicAuth.usernameSecretKey | quote }}
        - name: BASIC_AUTH_PASS
          valueFrom:
            secretKeyRef:
              name: {{ default "athens-proxy-basic-auth" .Values.basicAuth.secretName | quote }}
              key: {{ default "password" .Values.basicAuth.passwordSecretKey | quote }}
        {{- end }}
        {{- if .Values.configEnvVars }}
        {{- toYaml .Values.configEnvVars | nindent 8 }}
        {{- end }}
        ports:
        - containerPort: 3000
        {{- if or (eq .Values.storage.type "disk") .Values.upstreamProxy.enabled .Values.netrc.enabled .Values.sshGitServers .Values.gitconfig.enabled .Values.extraVolumeMounts }}
        volumeMounts:
        {{- end }}
        {{- if eq .Values.storage.type "disk" }}
        - name: storage-volume
          mountPath: {{ .Values.storage.disk.storageRoot | quote }}
        {{- end }}
        {{- if .Values.upstreamProxy.enabled }}
        - name: upstream-config
          mountPath: "/usr/local/lib"
          readOnly: true
        {{- end }}
        {{- if .Values.netrc.enabled }}
        - name: netrc
          mountPath: "/etc/netrc"
          readOnly: true
        {{- end }}
        {{- if .Values.sshGitServers }}
        - name: ssh-git-servers-config
          mountPath: {{ include "home" . }}/.ssh/config
          subPath: ssh_config
        - name: ssh-git-servers-config
          mountPath: {{ include "home" . }}/.gitconfig
          subPath: git_config
        - name: ssh-keys
          mountPath: /ssh-keys
        {{- end }}
        {{- if .Values.gitconfig.enabled }}
        - name: gitconfig
          mountPath: "/etc/gitconfig"
          subPath: "gitconfig"
        {{- end }}
        {{- range $server := .Values.sshGitServers }}
        {{- if $server.existingSecret }}
        - name: ssh-git-servers-secret-{{ $server.host | replace "." "-" }}
          mountPath: {{ include "home" $ }}/.ssh/id_rsa-{{ $server.host }}
          subPath: {{ $server.existingSecret.subPath | quote }}
        {{- end }}
        {{- end }}
        {{- with .Values.extraVolumeMounts }}
          {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.securityContext }}
        securityContext:
          {{- toYaml . | nindent 10 }}
        {{- end }}
        {{- with .Values.lifecycle }}
        lifecycle:
          {{- toYaml . | nindent 10 }}
        {{- end }}
        {{- with .Values.resources }}
        resources:
          {{- toYaml . | nindent 10 }}
        {{- end }}
      volumes:
      - name: storage-volume
      {{- if .Values.storage.disk.persistence.enabled }}
        persistentVolumeClaim:
          claimName: {{ include "fullname" . }}-storage
      {{- else }}
        emptyDir: {}
      {{- end }}
      {{- if .Values.upstreamProxy.enabled }}
      - name: upstream-config
        configMap:
          name: {{ include "fullname" . }}-upstream
      {{- end }}
      {{- if .Values.netrc.enabled }}
      - name: netrc
        secret:
          secretName: {{ .Values.netrc.existingSecret }}
      {{- end }}
      {{- if .Values.sshGitServers }}
      - name: ssh-keys
        emptyDir: {}
      - name: ssh-git-servers-config
        configMap:
          name: {{ include "fullname" . }}-ssh-git-servers
      - name: ssh-git-servers-secret
        secret:
          secretName: {{ include "fullname" . }}-ssh-git-servers
      {{- range $server := .Values.sshGitServers }}
      {{- if $server.existingSecret }}
      - name: ssh-git-servers-secret-{{ $server.host | replace "." "-" }}
        secret:
          secretName: {{ $server.existingSecret.name | quote }}
      {{- end }}
      {{- end }}
      {{- end }}
      {{- if .Values.gitconfig.enabled }}
      - name: gitconfig
        secret:
          secretName: {{ .Values.gitconfig.secretName }}
          items:
          - key: {{ .Values.gitconfig.secretKey }}
            path: "gitconfig"
      {{- end }}
      {{- with .Values.extraVolumes }}
        {{- toYaml . | nindent 6 }}
      {{- end }}
    {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
    {{- end }}