apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "elasticsearch-exporter.fullname" . }}
  labels:
    chart: {{ template "elasticsearch-exporter.chart" . }}
    app: {{ template "elasticsearch-exporter.name" . }}
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      app: {{ template "elasticsearch-exporter.name" . }}
      release: "{{ .Release.Name }}"
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: {{ template "elasticsearch-exporter.name" . }}
        release: "{{ .Release.Name }}"
      {{- if .Values.podAnnotations }}
      annotations:
{{ toYaml .Values.podAnnotations | indent 8 }}
      {{- end }}
    spec:
      {{- if .Values.serviceAccount.create  }}
      serviceAccountName: {{ template "elasticsearch-exporter.fullname" . }}
      {{- else }}
      serviceAccountName: {{ .Values.serviceAccount.name }}
      {{- end }}
{{- if .Values.priorityClassName }}
      priorityClassName: "{{ .Values.priorityClassName }}"
{{- end }}
{{- if .Values.image.pullSecret }}
      imagePullSecrets:
        - name: {{ .Values.image.pullSecret }}
{{- end }}
      restartPolicy: {{ .Values.restartPolicy }}
      {{- if .Values.securityContext.enabled }}
      securityContext:
        runAsNonRoot: true
        runAsUser: {{ .Values.securityContext.runAsUser }}
      {{- end }}
      containers:
        - name: {{ .Chart.Name }}
          env:
            {{- range $key, $value := .Values.env }}
            - name: {{ $key }}
              value: "{{ $value }}"
            {{- end }}
            {{- range $key, $value := .Values.extraEnvSecrets }}
            - name: {{ $key }}
              valueFrom:
                secretKeyRef:
                  name: {{ required "Must specify secret!" $value.secret }}
                  key: {{ required "Must specify key!" $value.key }}
            {{- end }}
          {{- if .Values.envFromSecret }}
          envFrom:
          - secretRef:
              name: {{ .Values.envFromSecret }}
          {{- end }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command: ["elasticsearch_exporter",
                    {{- with .Values.log.format }}
                    "--log.format={{ . }}",
                    {{- end }}
                    {{- with .Values.log.level }}
                    "--log.level={{ . }}",
                    {{- end }}
                    {{- if .Values.es.uri }}
                    "--es.uri={{ .Values.es.uri }}",
                    {{- end }}
                    {{- if .Values.es.all }}
                    "--es.all",
                    {{- end }}
                    {{- if .Values.es.indices }}
                    "--es.indices",
                    {{- end }}
                    {{- if .Values.es.indices_settings }}
                    "--es.indices_settings",
                    {{- end }}
                    {{- if .Values.es.shards }}
                    "--es.shards",
                    {{- end }}
                    {{- if .Values.es.snapshots }}
                    "--es.snapshots",
                    {{- end }}
                    {{- if .Values.es.cluster_settings }}
                    "--es.cluster_settings",
                    {{- end }}
                    "--es.timeout={{ .Values.es.timeout }}",
                    {{- if .Values.es.sslSkipVerify }}
                    "--es.ssl-skip-verify",
                    {{- end }}
                    {{- if .Values.es.ssl.enabled }}
                    "--es.ca={{.Values.es.ssl.ca.path }}",
                    {{- if .Values.es.ssl.client.enabled }}
                    "--es.client-cert={{ .Values.es.ssl.client.pemPath }}",
                    "--es.client-private-key={{ .Values.es.ssl.client.keyPath }}",
                    {{- end }}
                    {{- end }}
                    "--web.listen-address=:{{ .Values.service.httpPort }}",
                    "--web.telemetry-path={{ .Values.web.path }}"]
          securityContext:
            capabilities:
              drop:
                - SETPCAP
                - MKNOD
                - AUDIT_WRITE
                - CHOWN
                - NET_RAW
                - DAC_OVERRIDE
                - FOWNER
                - FSETID
                - KILL
                - SETGID
                - SETUID
                - NET_BIND_SERVICE
                - SYS_CHROOT
                - SETFCAP
            readOnlyRootFilesystem: true
          resources:
{{ toYaml .Values.resources | indent 12 }}
          ports:
            - containerPort: {{ .Values.service.httpPort }}
              name: http
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
            timeoutSeconds: 5
            periodSeconds: 5
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 1
            timeoutSeconds: 5
            periodSeconds: 5
          lifecycle:
            preStop:
              exec:
                command: ["/bin/bash", "-c", "sleep 20"]
          volumeMounts:
            {{- if and .Values.es.ssl.enabled (eq .Values.es.ssl.useExistingSecrets false) }}
            - mountPath: /ssl
              name: ssl
            {{- end }}
            {{- range .Values.secretMounts }}
            - name: {{ .name }}
              mountPath: {{ .path }}
              {{- if .subPath }}
              subPath: {{ .subPath }}
              {{- end }}
            {{- end }}
{{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.tolerations }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 }}
{{- end }}
{{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
{{- end }}
      volumes:
        {{- if and .Values.es.ssl.enabled (eq .Values.es.ssl.useExistingSecrets false) }}
        - name: ssl
          secret:
            secretName: {{ template "elasticsearch-exporter.fullname" . }}-cert
        {{- end }}
        {{- range .Values.secretMounts }}
        - name: {{ .name }}
          secret:
            secretName: {{ .secretName }}
        {{- end }}
