apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    {{ include "diagnosis-query.labels" . | nindent 4 }}
  name: {{ include "diagnosis-query.fullname" . }}
  namespace: {{ .Values.namespace }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{ include "diagnosis-query.labels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{ include "diagnosis-query.labels" . | nindent 8 }}
        {{- if eq .Values.vendor "azure" }}
        azure.workload.identity/use: "true"
        {{- end }}
    spec:
      containers:
      - args:
        - -vendor
        - {{ .Values.vendor }}
        - -region
        - {{ .Values.region }}
        - -duckDBSwitchAllEnabled={{ .Values.duckDB.switchAllEnabled }}
        - -duckDBSwitchTime
        - "{{ .Values.duckDB.switchTime }}"
        {{- if .Values.duckDB.grayTenantIds }}
        - -duckDBGrayTenantIds
        - "{{ join "," .Values.duckDB.grayTenantIds }}"
        {{- end }}
        {{- if eq .Values.vendor "aws" }}
        {{- $athena := .Values.athena | default dict }}
        {{- $workgroup := dig "workgroup" "" $athena }}
        {{- if $workgroup }}
        - -athena-workgroup
        - {{ $workgroup }}
        {{- end }}
        - -athena-database
        - {{ dig "database" "o11y-logs" $athena }}
        - -athena-catalog
        - {{ dig "catalog" "AwsDataCatalog" $athena }}
        {{- $explicitOutput := dig "outputLocation" "" $athena }}
        {{- $derivedOutput := "" }}
        {{- if .Values.env.BUCKET_NAME }}
        {{- $derivedOutput = printf "s3://%s/athena-results/logs-query/" .Values.env.BUCKET_NAME }}
        {{- end }}
        {{- $output := $explicitOutput | default $derivedOutput }}
        {{- if $output }}
        - -athena-output-location
        - {{ $output }}
        {{- end }}
        {{- end }}
        command:
          - /diagnosis-query
        image: {{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}
        env:
        {{- if .Values.env.topsqlOldClusters }}
          - name: TOPSQL_OLD_CLUSTERS
            value: "{{ .Values.env.topsqlOldClusters }}"
        {{- end }}
        {{- if .Values.env.BUCKET_NAME }}
          - name: BUCKET_NAME
            value: "{{ .Values.env.BUCKET_NAME }}"
        {{- end }}
        {{- if .Values.env.podMemoryLimitsMB }}
          - name: POD_MEMORY_LIMITS_MB
            valueFrom:
              resourceFieldRef:
                containerName: diagnosis-query
                resource: limits.memory
                divisor: 1Mi
        {{- end }}
        {{- if .Values.env.duckdbMemoryPercentage }}
          - name: DUCKDB_MEMORY_PERCENTAGE
            value: "{{ .Values.env.duckdbMemoryPercentage }}"
        {{- end }}
        {{- if eq .Values.vendor "alicloud" }}
          - name: AWS_ACCESS_KEY_ID
            valueFrom:
              secretKeyRef:
                name: o11y-regional-ram-credentials
                key: AWS_ACCESS_KEY_ID
          - name: AWS_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: o11y-regional-ram-credentials
                key: AWS_SECRET_ACCESS_KEY
          - name: AWS_REQUEST_CHECKSUM_CALCULATION
            value: "WHEN_REQUIRED"
          - name: AWS_RESPONSE_CHECKSUM_VALIDATION
            value: "WHEN_REQUIRED"
        {{- end }}
        {{- if eq .Values.vendor "azure" }}
          - name: AZURE_STORAGE_ACCOUNT
            value: "{{ .Values.env.storageAccount }}"
        {{- end }}
        {{- if .Values.env.envFromSecret }}
        envFrom:
          - secretRef:
              name: {{ .Values.env.envFromSecret }}
        {{- end }}
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        name: diagnosis-query
        ports:
        - containerPort: {{ .Values.service.targetPort }}
          protocol: TCP
        resources:
          limits:
            cpu: "{{ .Values.resources.limits.cpu }}"
            memory: {{ .Values.resources.limits.memory }}
          requests:
            cpu: "{{ .Values.resources.requests.cpu }}"
            memory: {{ .Values.resources.requests.memory }}
        volumeMounts:
        - mountPath: /cache
          name: diagnosis-query-cache
        {{- if eq .Values.vendor "azure" }}
        - name: azure-identity-token
          mountPath: /var/run/secrets/azure/tokens
          readOnly: true
        {{- end }}
      serviceAccountName: {{ .Values.serviceAccount.name }}
      serviceAccount: {{ .Values.serviceAccount.name }}
      {{- if eq .Values.vendor "azure" }}
      volumes:
      - name: azure-identity-token
        projected:
          sources:
          - serviceAccountToken:
              audience: api://AzureADTokenExchange
              expirationSeconds: 3600
              path: azure-identity-token
      {{- end }}
  volumeClaimTemplates:
  - apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
      labels:
        {{ include "diagnosis-query.labels" . | nindent 8 }}
      name: diagnosis-query-cache
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: {{ .Values.persistence.storage }}
      storageClassName: {{ .Values.persistence.storageClassName }}
      volumeMode: Filesystem