apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels: {{ include "external-dns.labels" . | indent 4 }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
  name: {{ template "external-dns.fullname" . }}
spec:
  template:
    metadata:
    {{- if .Values.podAnnotations }}
      annotations:
{{ toYaml .Values.podAnnotations | indent 8}}
    {{- end }}
      labels: {{ include "external-dns.labels" . | indent 8 }}
    spec:
      {{- if .Values.image.pullSecrets }}
      imagePullSecrets:
      {{- range $sec := .Values.image.pullSecrets }}
        - name: {{$sec | quote }}
      {{- end }}
      {{- end }}
      {{- if .Values.priorityClassName }}
      priorityClassName: "{{ .Values.priorityClassName }}"
      {{- end }}
      containers:
        - name: {{ template "external-dns.name" . }}
          image: "{{.Values.image.name}}:{{ .Values.image.tag }}"
          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
          args:
          {{- if .Values.logLevel }}
            - --log-level={{ .Values.logLevel }}
          {{- end }}
          {{- if .Values.publishInternalServices }}
            - --publish-internal-services
          {{- end }}
          {{- range .Values.domainFilters }}
            - --domain-filter={{ . }}
          {{- end }}
          {{- range .Values.zoneIdFilters }}
            - --zone-id-filter={{ . }}
          {{- end }}
            - --policy={{ .Values.policy }}
            - --provider={{ .Values.provider }}
            - --registry={{ .Values.registry }}
            - --interval={{ .Values.interval }}
          {{- if .Values.txtOwnerId }}
            - --txt-owner-id={{ .Values.txtOwnerId }}
          {{- end }}
          {{- if .Values.txtPrefix }}
            - --txt-prefix={{ .Values.txtPrefix }}
          {{- end }}
          {{- if .Values.annotationFilter }}
            - --annotation-filter={{ .Values.annotationFilter }}
          {{- end }}
          {{- range .Values.sources }}
            - --source={{ . }}
          {{- end }}
          {{ if .Values.dryRun }}
            - --dry-run
          {{- end }}
          {{- range $key, $value := .Values.extraArgs }}
            {{- if $value }}
            - --{{ $key }}={{ $value }}
            {{- else }}
            - --{{ $key }}
            {{- end }}
          {{- end }}
          {{- if eq .Values.provider "cloudflare" }}
            {{- if .Values.cloudflare.proxied }}
            - --cloudflare-proxied
            {{- end }}
          {{- end }}
          {{- if .Values.aws.zoneType }}
            - --aws-zone-type={{ .Values.aws.zoneType }}
          {{- end }}
          {{- if .Values.google.project }}
            - --google-project={{ .Values.google.project }}
          {{- end }}
          {{- if eq .Values.provider "infoblox" }}
            - --infoblox-grid-host={{ .Values.infoblox.gridHost }}
            {{- if .Values.infoblox.domainFilter }}
            - --domain-filter={{ .Values.infoblox.domainFilter }}
            {{- end }}
            {{- if .Values.infoblox.wapiPort }}
            - --infoblox-wapi-port={{ .Values.infoblox.wapiPort }}
            {{- end }}
            {{- if .Values.infoblox.wapiVersion }}
            - --infoblox-wapi-version={{ .Values.infoblox.wapiVersion }}
            {{- end }}
            {{- if .Values.infoblox.noSslVerify }}
            - --no-infoblox-ssl-verify
            {{- else }}
            - --infoblox-ssl-verify
            {{- end }}
          {{- end }}
          volumeMounts:
          {{- if or .Values.google.serviceAccountSecret .Values.google.serviceAccountKey }}
          - name: google-service-account
            mountPath: /etc/secrets/service-account/
          {{- end}}
          {{- if eq .Values.provider "azure" }}
          - name: azure-config-file
            {{- if not .Values.azure.secretName }}
            mountPath: /etc/kubernetes/azure.json
            {{- else }}
            mountPath: /etc/kubernetes/
            {{- end }}
            readOnly: true
          {{- end }}
          {{- if (and .Values.aws.secretKey .Values.aws.accessKey) }}
          - name: aws-credentials
            mountPath: {{ .Values.aws.credentialsPath }}
            readOnly: true
          {{- end }}
          {{- if and (eq .Values.provider "designate") .Values.designate.customCA.enabled }}
          - name: designate-custom-ca
            mountPath: {{ .Values.designate.customCA.directory }}
            readOnly: true
          {{- end }}
          env:
        {{- if or .Values.google.serviceAccountSecret .Values.google.serviceAccountKey }}
          - name: GOOGLE_APPLICATION_CREDENTIALS
            value: /etc/secrets/service-account/credentials.json
        {{- end }}
        {{- if or (eq .Values.provider "aws") (eq .Values.provider "aws-sd") }}
        {{- if .Values.aws.region }}
          - name: AWS_DEFAULT_REGION
            value: {{ .Values.aws.region }}
        {{- end }}
        {{- end }}
        {{- if and .Values.cloudflare.apiKey .Values.cloudflare.email }}
          - name: CF_API_KEY
            valueFrom:
              secretKeyRef:
                name: {{ template "external-dns.fullname" . }}
                key: cloudflare_api_key
          - name: CF_API_EMAIL
            value: "{{ .Values.cloudflare.email }}"
        {{- end }}
        {{- if .Values.digitalocean.apiToken }}
          - name: DO_TOKEN
            valueFrom:
              secretKeyRef:
                name: {{ template "external-dns.fullname" . }}
                key: digitalocean_api_token
        {{- end }}
        {{- if .Values.infoblox.wapiConnectionPoolSize }}
          - name: EXTERNAL_DNS_INFOBLOX_HTTP_POOL_CONNECTIONS
            value: "{{ .Values.infoblox.wapiConnectionPoolSize }}"
        {{- end }}
        {{- if .Values.infoblox.wapiHttpTimeout }}
          - name: EXTERNAL_DNS_INFOBLOX_HTTP_REQUEST_TIMEOUT
            value: "{{ .Values.infoblox.wapiHttpTimeout }}"
        {{- end }}
        {{- if and .Values.infoblox.wapiUsername .Values.infoblox.wapiPassword }}
          - name: EXTERNAL_DNS_INFOBLOX_WAPI_USERNAME
            valueFrom:
              secretKeyRef:
                name: {{ template "external-dns.fullname" . }}
                key: infoblox_wapi_username
          - name: EXTERNAL_DNS_INFOBLOX_WAPI_PASSWORD
            valueFrom:
              secretKeyRef:
                name: {{ template "external-dns.fullname" . }}
                key: infoblox_wapi_password
        {{- end }}
        {{- if and (eq .Values.provider "designate") .Values.designate.customCA.enabled }}
          - name: OPENSTACK_CA_FILE
            value: {{ .Values.designate.customCA.directory }}/{{ .Values.designate.customCA.filename }}
        {{- end }}
        {{- $root := . -}}
        {{- range .Values.extraEnv }}
          - name: {{ .name }}
            valueFrom:
          {{- if .valueFrom }}
{{ toYaml .valueFrom | indent 14 }}
          {{- else }}
              secretKeyRef:
                name: {{ template "external-dns.fullname" $root }}
                key: {{ .name }}
          {{- end }}
        {{- end }}
          livenessProbe:
            httpGet:
              path: /healthz
              port: 7979
          ports:
            - containerPort: 7979
        {{- if .Values.securityContext }}
          securityContext:
{{ toYaml .Values.securityContext | indent 12 }}
        {{- end }}
        {{- if .Values.resources }}
          resources:
{{ toYaml .Values.resources | indent 12 }}
        {{- end }}
      volumes:
      {{- if .Values.google.serviceAccountSecret }}
      - name: google-service-account
        secret:
          secretName: {{ .Values.google.serviceAccountSecret | quote }}
      {{- else if .Values.google.serviceAccountKey }}
      - name: google-service-account
        secret:
          secretName: {{ template "external-dns.fullname" . }}
      {{- end}}
      {{- if eq .Values.provider "azure" }}
      - name: azure-config-file
        {{- if (not .Values.azure.secretName)}}
        hostPath:
          path: /etc/kubernetes/azure.json
          type: File
        {{- else}}
        secret:
          secretName: {{.Values.azure.secretName}}
        {{- end}}
      {{- end }}
      {{- if (and .Values.aws.secretKey .Values.aws.accessKey) }}
      - name: aws-credentials
        secret:
          secretName: {{ template "external-dns.fullname" . }}
      {{- end }}
      {{- if and (eq .Values.provider "designate") .Values.designate.customCA.enabled }}
      - name: designate-custom-ca
        configMap:
          name: {{ template "external-dns.fullname" . }}
          items:
          - key: {{ .Values.designate.customCA.filename }}
            path: {{ .Values.designate.customCA.filename }}
      {{- end }}
    {{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
    {{- end }}
    {{- if .Values.tolerations }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 }}
    {{- end }}
{{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
    {{- end }}
      serviceAccountName: {{ if .Values.rbac.create }}{{ template "external-dns.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }}
