apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "fullname" . }}
  labels:
    app: {{ template "fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  replicas: {{ .Values.replicaCount }}
{{- if .Values.strategy }}
  strategy:
{{ toYaml .Values.strategy | indent 4 }}
  {{- if eq .Values.strategy.type "Recreate" }}
  rollingUpdate: null
  {{- end }}
{{- end }}
  selector:
    matchLabels:
      app: {{ template "fullname" . }}
      release: "{{ .Release.Name }}"
  template:
    metadata:
      labels:
        app: {{ template "fullname" . }}
        chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
        release: "{{ .Release.Name }}"
      annotations:
        checksum/upstream: {{ include (print $.Template.BasePath "/config-upstream.yaml") . | sha256sum }}
        checksum/ssh-config: {{ include (print $.Template.BasePath "/config-ssh-git-servers.yaml") . | sha256sum }}
        checksum/ssh-secret: {{ include (print $.Template.BasePath "/secret-ssh-git-servers.yaml") . | sha256sum }}
        {{- if .Values.annotations }}
{{ toYaml .Values.annotations | indent 8 }}
        {{- end }}
    spec:
      serviceAccount: {{ template "fullname" . }}
      {{- if .Values.sshGitServers }}
      initContainers:
        - name: copy-key-files
          image: alpine:3.9
          command:
            - sh
            - -c
          args: ["cp /root/.ssh/id_rsa* /ssh-keys && chmod 400 /ssh-keys/*"]
          volumeMounts:
          - name: ssh-keys
            mountPath: /ssh-keys
          {{- range $server := .Values.sshGitServers }}
          - name: ssh-git-servers-secret
            mountPath: /root/.ssh/id_rsa-{{ $server.host }}
            subPath: id_rsa-{{ $server.host }}
          {{- end }}
      {{- end }}
      containers:
      - name: {{ template "fullname" . }}
        image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
        livenessProbe:
          failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
          httpGet:
            path: "/healthz"
            port: 3000
          periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
          successThreshold: {{ .Values.livenessProbe.successThreshold }}
          timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
        readinessProbe:
          httpGet:
            path: "{{ template "readinessPath" . }}"
            port: 3000
        env:
        - name: ATHENS_GOGET_WORKERS
        {{- if .Values.goGetWorkers }}
          value: {{ .Values.goGetWorkers | quote }}
        {{- else }}
          value: "3"
        {{- end }}
        {{- if .Values.configEnvVars }}
{{ toYaml .Values.configEnvVars | indent 8 }}
        {{- end }}
        - name: ATHENS_STORAGE_TYPE
          value: {{ .Values.storage.type | quote }}
        {{- if eq .Values.storage.type "disk"}}
        - name: ATHENS_DISK_STORAGE_ROOT
          value: {{ .Values.storage.disk.storageRoot | quote }}
        {{- else if eq .Values.storage.type "mongo"}}
        - name: ATHENS_MONGO_STORAGE_URL
          value: {{ .Values.storage.mongo.url | quote }}
        {{- else if eq .Values.storage.type "s3" }}
        - name: AWS_REGION
          value: {{ .Values.storage.s3.region | quote }}
        - name: ATHENS_S3_BUCKET_NAME
          value: {{ .Values.storage.s3.bucket | quote }}
        - name: AWS_USE_DEFAULT_CONFIGURATION
          value: {{ .Values.storage.s3.useDefaultConfiguration | quote }}
        - name: AWS_FORCE_PATH_STYLE
          value: {{ .Values.storage.s3.ForcePathStyle | quote }}
        {{- if .Values.storage.s3.access_key_id }}
        - name: AWS_ACCESS_KEY_ID
          value: {{ .Values.storage.s3.access_key_id | quote }}
        {{- end }}
        {{- if .Values.storage.s3.secret_access_key }}
        - name: AWS_SECRET_ACCESS_KEY
          value: {{ .Values.storage.s3.secret_access_key | quote }}
        {{- end }}
        {{- if .Values.storage.s3.session_token }}
        - name: AWS_SESSION_TOKEN
          value: {{ .Values.storage.s3.session_token | quote }}
        {{- end }}
        {{- else if eq .Values.storage.type "gcp"}}
        - name: GOOGLE_CLOUD_PROJECT
          value: {{ .Values.storage.gcp.projectID | quote }}
        - name: ATHENS_STORAGE_GCP_BUCKET
          value: {{ .Values.storage.gcp.bucket | quote }}
        {{- if .Values.storage.gcp.serviceAccount }}
        - name: ATHENS_STORAGE_GCP_JSON_KEY
          value: {{ .Values.storage.gcp.serviceAccount | b64enc | quote }}
        {{- end }}
        {{- else if eq .Values.storage.type "minio" }}
        {{- if .Values.storage.minio.endpoint }}
        - name: ATHENS_MINIO_ENDPOINT
          value: {{ .Values.storage.minio.endpoint | quote }}
        {{- end }}
        {{- if .Values.storage.minio.accessKey }}
        - name: ATHENS_MINIO_ACCESS_KEY_ID
          value: {{ .Values.storage.minio.accessKey | quote }}
        {{- end }}
        {{- if .Values.storage.minio.secretKey }}
        - name: ATHENS_MINIO_SECRET_ACCESS_KEY
          value: {{ .Values.storage.minio.secretKey | quote }}
        {{- end }}
        {{- if .Values.storage.minio.bucket }}
        - name: ATHENS_MINIO_BUCKET_NAME
          value: {{ .Values.storage.minio.bucket | quote }}
        {{- end }}
        {{- end }}
        {{- if .Values.netrc.enabled }}
        - name: ATHENS_NETRC_PATH
          value: "/etc/netrc/.netrc"
        {{- end }}
        {{- if .Values.upstreamProxy.enabled }}
        - name: ATHENS_FILTER_FILE
          value: "/usr/local/lib/FilterForUpstreamProxy"
        - name: ATHENS_GLOBAL_ENDPOINT
          value: {{ .Values.upstreamProxy.url | quote }}
        {{- end }}
        {{- if .Values.jaeger.enabled }}
        - name: ATHENS_TRACE_EXPORTER_URL
          value: {{ .Values.jaeger.url | quote }}
        - name: ATHENS_TRACE_EXPORTER
          value: "jaeger"
        {{- end }}
        {{- if .Values.basicAuth.enabled }}
        - name: BASIC_AUTH_USER
          valueFrom:
            secretKeyRef:
              name: {{ default "athens-proxy-basic-auth" .Values.basicAuth.secretName | quote }}
              key: {{ default "username" .Values.basicAuth.usernameSecretKey | quote }}
        - name: BASIC_AUTH_PASS
          valueFrom:
            secretKeyRef:
              name: {{ default "athens-proxy-basic-auth" .Values.basicAuth.secretName | quote }}
              key: {{ default "password" .Values.basicAuth.passwordSecretKey | quote }}
        {{- end }}
        ports:
        - containerPort: 3000
        {{- if or (eq .Values.storage.type "disk") .Values.upstreamProxy.enabled .Values.netrc.enabled .Values.sshGitServers .Values.gitconfig.enabled}}
        volumeMounts:
        {{- end }}
        {{- if eq .Values.storage.type "disk" }}
        - name: storage-volume
          mountPath: {{ .Values.storage.disk.storageRoot | quote }}
        {{- end }}
        {{- if .Values.upstreamProxy.enabled }}
        - name: upstream-config
          mountPath: "/usr/local/lib"
          readOnly: true
        {{- end }}
        {{- if .Values.netrc.enabled }}
        - name: netrc
          mountPath: "/etc/netrc"
          readOnly: true
        {{- end }}
        {{- if .Values.sshGitServers }}
        - name: ssh-git-servers-config
          mountPath: /root/.ssh/config
          subPath: ssh_config
        - name: ssh-git-servers-config
          mountPath: /root/.gitconfig
          subPath: git_config
        - name: ssh-keys
          mountPath: /ssh-keys
        {{- end }}
        {{- if .Values.gitconfig.enabled }}
        - name: gitconfig
          mountPath: "/etc/gitconfig"
          subPath: "gitconfig"
        {{- end }}
      {{- with .Values.resources }}
        resources:
{{ toYaml . | indent 10 }}
      {{- end }}
      volumes:
      - name: storage-volume
      {{- if .Values.storage.disk.persistence.enabled }}
        persistentVolumeClaim:
          claimName: {{ template "fullname" . }}-storage
      {{- else }}
        emptyDir: {}
      {{- end }}
      {{- if .Values.upstreamProxy.enabled }}
      - name: upstream-config
        configMap:
          name: {{ template "fullname" . }}-upstream
      {{- end }}
      {{- if .Values.netrc.enabled }}
      - name: netrc
        secret:
          secretName: {{ .Values.netrc.existingSecret }}
      {{- end }}
      {{- if .Values.sshGitServers }}
      - name: ssh-keys
        emptyDir: {}
      - name: ssh-git-servers-config
        configMap:
          name: {{ template "fullname" . }}-ssh-git-servers
      - name: ssh-git-servers-secret
        secret:
          secretName: {{ template "fullname" . }}-ssh-git-servers
      {{- end }}
      {{- if .Values.gitconfig.enabled }}
      - name: gitconfig
        secret:
          secretName: {{ .Values.gitconfig.secretName }}
          items:
          - key: {{ .Values.gitconfig.secretKey }}
            path: "gitconfig"
      {{- end }}
    {{- with .Values.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
    {{- end }}
