{{- if .Values.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Values.serviceAccount.name }}
---
{{- if .Values.rbac.create }}
# Deploy/undeploy verbs for the two temporary vmselects, nothing else.
# create cannot be scoped by resourceName (Kubernetes limitation), so it
# grants create on the kinds cluster-wide within the namespace; every other
# verb is pinned to the two fixed names. The names are fixed by the
# vm-migration binary (schema.VmselectMigrationName / VmselectCandidateName)
# and must stay in sync with it.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: vm-migration-vmselect
  namespace: {{ .Values.rbac.namespace }}
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["create"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["vmselect-migration", "vmselect-candidate"]
    verbs: ["get", "update", "delete"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["services"]
    resourceNames: ["vmselect-migration", "vmselect-candidate"]
    verbs: ["get", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: vm-migration-vmselect
  namespace: {{ .Values.rbac.namespace }}
subjects:
  - kind: ServiceAccount
    name: {{ .Values.serviceAccount.name }}
    namespace: {{ .Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: vm-migration-vmselect
---
{{- end }}
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: vm-migration
  annotations:
    # Migration artifacts outlive the workload: keep the volume when the
    # release is uninstalled.
    helm.sh/resource-policy: keep
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: {{ .Values.persistence.size }}
{{- with .Values.persistence.storageClassName }}
  storageClassName: {{ . }}
{{- end }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vm-migration
spec:
  # Single-instance workload on a ReadWriteOnce volume: terminate the old
  # pod before creating the new one so two serve processes never share the
  # migrations dir.
  strategy:
    type: Recreate
  replicas: {{ .Values.replicas }}
  selector:
    matchLabels:
      app: vm-migration
  template:
    metadata:
      labels:
        app: vm-migration
    spec:
      serviceAccountName: {{ .Values.serviceAccount.name }}
      volumes:
        - name: workspace
          persistentVolumeClaim:
            claimName: vm-migration
      containers:
        - name: migration
          image: "{{ .Values.image.repository }}{{- if .Values.image.tag }}:{{ .Values.image.tag }}{{- end }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          {{- with .Values.args }}
          args:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          ports:
            - containerPort: 8080
          readinessProbe:
            httpGet:
              path: /migrations
              port: 8080
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          volumeMounts:
            - name: workspace
              mountPath: /workspace
      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
---
apiVersion: v1
kind: Service
metadata:
  name: vm-migration
spec:
  type: ClusterIP
  ports:
    - name: http
      port: 8080
      targetPort: 8080
      protocol: TCP
  selector:
    app: vm-migration
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: vm-migration-read
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    nginx.ingress.kubernetes.io/use-regex: "true"
spec:
  ingressClassName: {{ .Values.ingress.className }}
  rules:
    - http:
        paths:
          - backend:
              service:
                name: vm-migration
                port:
                  number: 8080
            path: /internal/vm-migration(/|$)(.*)
            pathType: ImplementationSpecific
{{- end }}