apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  labels:
    app: {{ template "kube2iam.name" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
  name: {{ template "kube2iam.fullname" . }}
spec:
  template:
    metadata:
    {{- if .Values.podAnnotations }}
      annotations:
{{ toYaml .Values.podAnnotations | indent 8 }}
    {{- end }}
      labels:
        app: {{ template "kube2iam.name" . }}
        release: {{ .Release.Name }}
      {{- if .Values.podLabels }}
{{ toYaml .Values.podLabels | indent 8 }}
      {{- end }}
    spec:
      containers:
        - name: kube2iam
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
          args:
            - --host-interface={{ .Values.host.interface }}
            - --node=$(NODE_NAME)
          {{- if .Values.host.iptables }}
            - --host-ip={{ .Values.host.ip }}
          {{- end }}
            - --iptables={{ .Values.host.iptables }}
          {{- range $key, $value := .Values.extraArgs }}
            {{- if $value }}
            - --{{ $key }}={{ $value }}
            {{- else }}
            - --{{ $key }}
            {{- end }}
          {{- end }}
          {{- if .Values.verbose }}
            - --verbose
          {{- end }}
            - --app-port={{ .Values.host.port }}
          env:
            - name: HOST_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          {{- if and .Values.aws.secret_key .Values.aws.access_key }}
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: {{ template "kube2iam.fullname" . }}
                  key: aws_access_key_id
            - name: AWS_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ template "kube2iam.fullname" . }}
                  key: aws_secret_access_key
          {{- end }}
          {{- if .Values.aws.region }}
            - name: AWS_DEFAULT_REGION
              value: {{ .Values.aws.region }}
          {{- end }}
          {{- range $name, $value := .Values.extraEnv }}
            - name: {{ $name }}
              value: {{ quote $value }}
          {{- end }}
          ports:
            - containerPort: {{ .Values.host.port }}
        {{- if .Values.probe }}
          livenessProbe:
            httpGet:
              path: /healthz
              port: {{ .Values.host.port }}
              scheme: HTTP
            initialDelaySeconds: 30
            periodSeconds: 5
            successThreshold: 1
            failureThreshold: 3
            timeoutSeconds: 1
        {{- end }}
          resources:
{{ toYaml .Values.resources | indent 12 }}
        {{- if .Values.host.iptables }}
          securityContext:
            privileged: true
        {{- end }}
      hostNetwork: true
    {{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
    {{- end }}
    {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
    {{- end }}
    {{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
    {{- end }}
      serviceAccountName: {{ if .Values.rbac.create }}{{ template "kube2iam.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 }}
{{- if semverCompare "^1.6-0" .Capabilities.KubeVersion.GitVersion }}
  updateStrategy:
    type: {{ .Values.updateStrategy }}
{{- end }}
