apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "ops-server.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "ops-server.labels" . | nindent 4 }}
spec:
  replicas: 1
  selector:
    matchLabels:
      {{- include "ops-server.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      annotations:
        {{- with .Values.podAnnotations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        # Force restart on config changes
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
      labels:
        {{- include "ops-server.selectorLabels" . | nindent 8 }}
        {{- if eq .Values.opsServer.config.vendor "azure" }}
        azure.workload.identity/use: "true"
        {{- end }}
    spec:
      serviceAccountName: {{ .Values.serviceAccount.name }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      volumes:
        - name: opsconfig
          configMap:
            name: {{ include "ops-server.fullname" . }}-config
        - name: flux-tmp
          emptyDir: {}
        - name: flux-cache
          emptyDir: {}
      containers:
        # 1. Ops Server Container
        - name: ops-server
          image: "{{ .Values.global.registry }}/{{ .Values.opsServer.image.repository }}:{{ .Values.opsServer.image.tag }}"
          imagePullPolicy: {{ .Values.opsServer.image.pullPolicy }}
          args:
            - -clientMode={{ .Values.opsServer.config.clientMode }}
            - -port={{ .Values.opsServer.config.port }}
            - -metricsBindAddress=:{{ .Values.opsServer.config.metricsPort }}
            - -logLevel={{ .Values.opsServer.config.logLevel }}
            - -vendor={{ .Values.opsServer.config.vendor }}
            - -leaderElect={{ .Values.opsServer.config.enableLeaderElection }}
            - -selfMonitorEndpoint={{ .Values.opsServer.config.selfMonitorEndpoint }}
          ports:
            - name: ops-http
              containerPort: {{ .Values.opsServer.config.port }}
              protocol: TCP
            - name: ops-metrics
              containerPort: {{ .Values.opsServer.config.metricsPort }}
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /health
              port: ops-http
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /health
              port: ops-http
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
            {{- toYaml .Values.opsServer.resources | nindent 12 }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          volumeMounts:
            - name: opsconfig
              mountPath: /config/
          env:
            - name: RUNTIME_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            {{- if and (eq .Values.opsServer.config.vendor "azure") (and .Values.opsServer.azure.subscriptionId .Values.opsServer.azure.resourceGroup) }}
            - name: AZURE_SUBSCRIPTION_ID
              value: {{ .Values.opsServer.azure.subscriptionId | quote }}
            - name: AZURE_RESOURCE_GROUP
              value: {{ .Values.opsServer.azure.resourceGroup | quote }}
            {{- end }}

        # 2. FluxCD Source Controller Container
        - name: source-controller
          image: "{{ .Values.sourceController.image.repository }}:{{ .Values.sourceController.image.tag }}"
          imagePullPolicy: {{ .Values.sourceController.image.pullPolicy }}
          args:
            - --metrics-addr=:{{ .Values.sourceController.config.metricsPort }}
            - --health-addr=:{{ .Values.sourceController.config.healthPort }}
            - --storage-addr=:{{ .Values.sourceController.config.httpPort }}
            - --watch-all-namespaces={{ .Values.sourceController.config.watchAllNamespaces }}
            - --log-level={{ .Values.sourceController.config.logLevel }}
            - --log-encoding=json
            - --enable-leader-election
            - --storage-path=/data
            - --storage-adv-addr=source-controller.{{ .Release.Namespace }}.svc.cluster.local.
          ports:
            - name: source-http
              containerPort: {{ .Values.sourceController.config.httpPort }}
              protocol: TCP
            - name: source-healthz
              containerPort: {{ .Values.sourceController.config.healthPort }}
              protocol: TCP
            - name: source-metrics
              containerPort: {{ .Values.sourceController.config.metricsPort }}
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /healthz
              port: source-healthz
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /readyz
              port: source-healthz
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
            {{- toYaml .Values.sourceController.resources | nindent 12 }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          volumeMounts:
            - name: flux-tmp
              mountPath: /tmp
            - name: flux-cache
              mountPath: /data
          env:
            - name: RUNTIME_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            {{- if or (eq .Values.opsServer.config.vendor "aws") (eq .Values.flux.repo.provider "aws") }}
            - name: AWS_REGION
              value: {{ .Values.global.region }}
            - name: AWS_DEFAULT_REGION
              value: {{ .Values.global.region }}
            {{- end }}

        # 3. FluxCD Helm Controller Container
        - name: helm-controller
          image: "{{ .Values.helmController.image.repository }}:{{ .Values.helmController.image.tag }}"
          imagePullPolicy: {{ .Values.helmController.image.pullPolicy }}
          args:
            - --watch-all-namespaces={{ .Values.helmController.config.watchAllNamespaces }}
            - --metrics-addr=:{{ .Values.helmController.config.metricsPort }}
            - --health-addr=:{{ .Values.helmController.config.healthPort }}
            - --log-level={{ .Values.helmController.config.logLevel }}
            - --log-encoding=json
            - --enable-leader-election
          ports:
            - name: helm-healthz
              containerPort: {{ .Values.helmController.config.healthPort }}
              protocol: TCP
            - name: helm-metrics
              containerPort: {{ .Values.helmController.config.metricsPort }}
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /healthz
              port: helm-healthz
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /readyz
              port: helm-healthz
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
            {{- toYaml .Values.helmController.resources | nindent 12 }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          volumeMounts:
            - name: flux-tmp
              mountPath: /tmp
          env:
            - name: RUNTIME_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            {{- if or (eq .Values.opsServer.config.vendor "aws") (eq .Values.flux.repo.provider "aws") }}
            - name: AWS_REGION
              value: {{ .Values.global.region }}
            - name: AWS_DEFAULT_REGION
              value: {{ .Values.global.region }}
            {{- end }}

      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}