apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "openvpn.fullname" . }}
  labels:
    app: {{ template "openvpn.name" . }}
    chart: {{ template "openvpn.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  replicas: {{ .Values.replicaCount }}
{{- if .Values.updateStrategy }}
  strategy:
{{ toYaml .Values.updateStrategy | indent 4 }}
{{- end }}
  selector:
    matchLabels:
      app: {{ template "openvpn.name" . }}
      release: {{ .Release.Name }}
  template:
    metadata:
      labels:
        app: {{ template "openvpn.name" . }}
        release: {{ .Release.Name }}
      annotations:
        checksum/config: {{ include (print .Template.BasePath "/config-openvpn.yaml") . | sha256sum }}
        {{- if .Values.podAnnotations }}
{{ toYaml .Values.podAnnotations | indent 8 }}
        {{- end }}
    spec:
{{- if .Values.ipForwardInitContainer }}
      initContainers:
        - args:
            - -c
            - sysctl -w net.ipv4.ip_forward=1
          command:
            - /bin/sh
          image: busybox:1.29
          imagePullPolicy: IfNotPresent
          name: sysctl
          resources:
            requests:
              cpu: 1m
              memory: 1Mi
          securityContext:
            privileged: true
{{- end }}
      containers:
      - name: {{ .Chart.Name }}
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        command: ["/etc/openvpn/setup/configure.sh"]
        ports:
        - containerPort: {{ .Values.service.internalPort }}
          {{- if .Values.service.hostPort }}
          hostPort: {{ .Values.service.hostPort }}
          {{- end }}
          name: openvpn
        securityContext:
          capabilities:
            add:
              - NET_ADMIN
        readinessProbe:
          initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
          periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
          successThreshold: {{ .Values.readinessProbe.successThreshold }}
          exec:
            command:
            - nc
        {{- if eq .Values.openvpn.OVPN_PROTO "udp" }}
            - -u
        {{- end }}
            - -z
            - 127.0.0.1
            - "{{ .Values.service.internalPort }}"
        resources:
          requests:
            cpu: "{{ .Values.resources.requests.cpu }}"
            memory: "{{ .Values.resources.requests.memory }}"
          limits:
            cpu: "{{ .Values.resources.limits.cpu }}"
            memory: "{{ .Values.resources.limits.memory }}"
        volumeMounts:
          - mountPath: /etc/openvpn/setup
            name: openvpn
            readOnly: false
          - mountPath: /etc/openvpn/certs
            {{- if .Values.persistence.subPath }}
            subPath: {{ .Values.persistence.subPath }}
            {{- end }}
            name: certs
            readOnly: {{ if .Values.openvpn.keystoreSecret }}true{{ else }}false{{ end }}
            {{- if .Values.openvpn.ccd.enabled }}
          - mountPath: /etc/openvpn/ccd
            name: openvpn-ccd
            {{- end }}
      volumes:
      - name: openvpn
        configMap:
          name: {{ template "openvpn.fullname" . }}
          defaultMode: 0775
      {{- if .Values.openvpn.ccd.enabled }}
      - name: openvpn-ccd
        configMap:
          name: {{ template "openvpn.fullname" . }}-ccd
          defaultMode: 0775
      {{- end }}
      - name: certs
        {{- if .Values.persistence.enabled }}
        persistentVolumeClaim:
          claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ template "openvpn.fullname" . }}{{- end }}
        {{- else if .Values.openvpn.keystoreSecret }}
        secret:
          secretName: "{{ .Values.openvpn.keystoreSecret }}"
          defaultMode: 0600
          items:
          - key: "server.key"
            path: "pki/private/server.key"
          - key: "ca.crt"
            path: "pki/ca.crt"
          - key: "server.crt"
            path: "pki/issued/server.crt"
          - key: "dh.pem"
            path: "pki/dh.pem"
          {{- if .Values.openvpn.useCrl }}
          - key: "crl.pem"
            path: "crl.pem"
            mode: 0644
          {{- end }}
          {{- if .Values.openvpn.taKey }}
          - key: "ta.key"
            path: "pki/ta.key"
          {{- end }}
        {{- else }}
        emptyDir: {}
        {{- end -}}
      {{- if .Values.nodeSelector }}
      nodeSelector:
        {{ toYaml .Values.nodeSelector }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
      {{- end }}

{{- if .Values.imagePullSecretName }}
      imagePullSecrets:
      - name: {{ .Values.imagePullSecretName }}
{{- end -}}

