{{- if (hasKey .Values.controllerManager "create" | ternary .Values.controllerManager.create true) }}
apiVersion: apps/v1
kind: Deployment
metadata:
  {{- if eq .Values.appendReleaseSuffix true}}
  name: tidb-controller-manager-{{.Release.Name }}
  {{- else }}
  name: tidb-controller-manager
  {{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: controller-manager
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
spec:
  replicas: {{ .Values.controllerManager.replicas }}
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "chart.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: controller-manager
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ template "chart.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name }}
        app.kubernetes.io/component: controller-manager
{{- if .Values.controllerManager.podAnnotations }}
      annotations:
{{ toYaml .Values.controllerManager.podAnnotations | indent 8 }}
{{ end }}
    spec:
    {{- if .Values.controllerManager.serviceAccount }}
      {{- if eq .Values.appendReleaseSuffix true}}
      serviceAccount: {{ .Values.controllerManager.serviceAccount }}-{{ .Release.Name }}
      {{- else }}
      serviceAccount: {{ .Values.controllerManager.serviceAccount }}
      {{- end }}
    {{- end }}
      automountServiceAccountToken: {{ .Values.controllerManager.automountServiceAccountToken }}
    {{- if .Values.imagePullSecrets }}
      imagePullSecrets:
  {{ toYaml .Values.imagePullSecrets | indent 6 }}
    {{- end }}
      containers:
      - name: tidb-operator
        image: {{ .Values.operatorImage }}
        imagePullPolicy: {{ .Values.imagePullPolicy | default "IfNotPresent" }}
        {{- if .Values.controllerManager.resources }}
        resources:
{{ toYaml .Values.controllerManager.resources | indent 12 }}
        {{- end }}
        livenessProbe:
          tcpSocket:
            port: 6060
          initialDelaySeconds: 30
          periodSeconds: 10
          failureThreshold: 10
        command:
          - /usr/local/bin/tidb-controller-manager
          {{- if .Values.tidbBackupManagerImage }}
          - -tidb-backup-manager-image={{ .Values.tidbBackupManagerImage }}
          {{- end }}
          - -tidb-discovery-image={{ .Values.operatorImage }}
          - -cluster-scoped={{ .Values.clusterScoped }}
          - -cluster-permission-node={{ include "controller-manager.cluster-permissions.nodes" . | trim }}
          - -cluster-permission-pv={{ include "controller-manager.cluster-permissions.persistentvolumes" . | trim }}
          - -cluster-permission-sc={{ include "controller-manager.cluster-permissions.storageclasses" . | trim }}
         {{- if eq .Values.controllerManager.autoFailover true }}
          - -auto-failover=true
         {{- end }}
         {{- if eq .Values.controllerManager.autoFailover false }}
          - -auto-failover=false
         {{- end }}
          - -pd-failover-period={{ .Values.controllerManager.pdFailoverPeriod | default "5m" }}
          - -tikv-failover-period={{ .Values.controllerManager.tikvFailoverPeriod | default "5m" }}
          - -tiflash-failover-period={{ .Values.controllerManager.tiflashFailoverPeriod | default "5m" }}
          - -tidb-failover-period={{ .Values.controllerManager.tidbFailoverPeriod | default "5m" }}
          - -dm-master-failover-period={{ .Values.controllerManager.dmMasterFailoverPeriod | default "5m" }}
          - -dm-worker-failover-period={{ .Values.controllerManager.dmWorkerFailoverPeriod | default "5m" }}
         {{- if eq .Values.controllerManager.detectNodeFailure true }}
          - -detect-node-failure=true
          - -pod-hard-recovery-period={{ .Values.controllerManager.podHardRecoveryPeriod | default "24h" }}
         {{- end }}
          - -v={{ .Values.controllerManager.logLevel }}
          {{- if .Values.testMode }}
          - -test-mode={{ .Values.testMode }}
          {{- end}}
          {{- if .Values.features }}
          - -features={{ join "," .Values.features }}
          {{- end }}
          {{- if .Values.controllerManager.workers }}
          - -workers={{ .Values.controllerManager.workers | default 5 }}
          {{- end }}
          {{- if .Values.controllerManager.selector }}
          {{- $label := join "," .Values.controllerManager.selector }}
          - -selector={{ $label }}
          {{- end }}
         {{- if .Values.controllerManager.leaderLeaseDuration }}
          - -leader-lease-duration={{ .Values.controllerManager.leaderLeaseDuration }}
         {{- end }}
         {{- if .Values.controllerManager.leaderRenewDeadline }}
          - -leader-renew-deadline={{ .Values.controllerManager.leaderRenewDeadline }}
         {{- end }}
         {{- if .Values.controllerManager.leaderRetryPeriod }}
          - -leader-retry-period={{ .Values.controllerManager.leaderRetryPeriod }}
         {{- end }}
         {{- if .Values.controllerManager.leaderResourceLock }}
          - -leader-resource-lock={{ .Values.controllerManager.leaderResourceLock }}
         {{- end }}
         {{- if .Values.controllerManager.kubeClientQPS }}
          - -kube-client-qps={{ .Values.controllerManager.kubeClientQPS }}
         {{- end }}
         {{- if .Values.controllerManager.kubeClientBurst }}
          - -kube-client-burst={{ .Values.controllerManager.kubeClientBurst }}
         {{- end }}
        env:
          - name: NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: TZ
            value: {{ .Values.timezone | default "UTC" }}
          {{- if eq .Values.appendReleaseSuffix true}}
          - name: HELM_RELEASE
            value: {{ .Release.Name }}
          {{- end }}
          {{- with .Values.controllerManager.env }}
{{ toYaml . | indent 10 }}
          {{- end }}
        {{- if not .Values.controllerManager.automountServiceAccountToken }}
        volumeMounts:
        - name: sa-token
          mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          readOnly: true
        {{- end }}
      {{- with .Values.controllerManager.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
      {{- end }}

      {{- with .Values.controllerManager.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
      {{- end }}

      {{- with .Values.controllerManager.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
      {{- end }}

      {{- if .Values.controllerManager.priorityClassName }}
      priorityClassName: {{ .Values.controllerManager.priorityClassName }}
      {{- end }}
    {{- with .Values.controllerManager.securityContext }}
      securityContext:
{{ toYaml . | indent 8 }}
    {{- end}}
    {{- if not .Values.controllerManager.automountServiceAccountToken }}
      volumes:
      - name: sa-token
        projected:
          sources:
          - serviceAccountToken:
              path: token
          - configMap:
              name: kube-root-ca.crt
              items:
              - key: ca.crt
                path: ca.crt
          - downwardAPI:
              items:
              - path: namespace
                fieldRef:
                  fieldPath: metadata.namespace
    {{- end }}
{{- end }}