apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "service-proxy.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "service-proxy.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "service-proxy.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "service-proxy.selectorLabels" . | nindent 8 }}
      {{- if .Values.auditSidecar.enabled }}
      annotations:
        tidbcloud.com/audit-config: |
        {{- toYaml .Values.auditSidecar.config | nindent 10 }}
      {{- end }}
    spec:
      serviceAccountName: {{ include "service-proxy.serviceAccountName" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      affinity:
        {{- if .Values.affinity }}
        {{- toYaml .Values.affinity | nindent 8 }}
        {{- else }}
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app.kubernetes.io/name
                  operator: In
                  values:
                  - {{ include "service-proxy.name" . }}
              namespaces:
              - {{ .Release.Namespace }}
              topologyKey: kubernetes.io/hostname
            weight: 100
          - podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app.kubernetes.io/name
                  operator: In
                  values:
                  - {{ include "service-proxy.name" . }}
              namespaces:
              - {{ .Release.Namespace }}
              topologyKey: topology.kubernetes.io/zone
            weight: 100
        {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      containers:
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          ports:
          - containerPort: 8080
            name: http
          - containerPort: 8081
            name: metrics
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          command:
          - /service-proxy
          - --config
          - /etc/service-proxy/config.yaml
          {{- with .Values.env }}
          env:
            {{- toYaml . | nindent 10 }}
          {{- end }}
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /readyz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
          volumeMounts:
          - name: config
            mountPath: /etc/service-proxy
            readOnly: true
        {{- if .Values.auditSidecar.enabled }}
          - name: audit-log
            mountPath: /var/log
        - name: auditlog
          image: "{{ .Values.auditSidecar.image }}"
          imagePullPolicy: IfNotPresent
          ports:
          - containerPort: 9090
            name: metrics
            protocol: TCP
          resources:
            limits:
              cpu: 100m
              memory: 256Mi
            requests:
              cpu: 100m
              memory: 256Mi
          securityContext:
            runAsUser: 1000
            runAsGroup: 2000
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - NET_RAW
            privileged: false
            readOnlyRootFilesystem: true
          volumeMounts:
          - name: audit-log
            mountPath: /var/log
          - name: podinfo
            mountPath: /etc/podinfo
            readOnly: true
          command:
          - /audit-ng
          - server
          - --config=/etc/podinfo/audit-config.yaml
          env:
          - name: TZ
            value: UTC
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
        {{- end }}
      volumes:
      - name: config
        configMap:
          name: {{ include "service-proxy.fullname" . }}
      {{- if .Values.auditSidecar.enabled }}
      - name: podinfo
        downwardAPI:
          defaultMode: 420
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.annotations['tidbcloud.com/audit-config']
            path: audit-config.yaml
      - name: audit-log
        ephemeral:
          volumeClaimTemplate:
            {{- if .Values.persistentVolumeClaimLabels }}
            metadata:
              labels:
                {{- toYaml .Values.persistentVolumeClaimLabels | nindent 16 }}
            {{- end }}
            spec:
              storageClassName: "cloud-ssd"
              resources:
                requests:
                  storage: "1Gi"
              accessModes: [ "ReadWriteOnce" ]
      {{- end }}