apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "hlf-ca.fullname" . }}
  labels:
{{ include "labels.standard" . | indent 4 }}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: {{ include "hlf-ca.name" . }}
      release: {{ .Release.Name }}
  # Ensure we allow our pod to be unavailable, so we can upgrade
  strategy:
    rollingUpdate:
      maxUnavailable: 1
  template:
    metadata:
      labels:
{{ include "labels.standard" . | indent 8 }}
    spec:
      volumes:
        - name: data
        {{- if .Values.persistence.enabled }}
          persistentVolumeClaim:
            claimName: {{ .Values.persistence.existingClaim | default (include "hlf-ca.fullname" .) }}
        {{- else }}
          emptyDir: {}
        {{- end }}
        {{- if (and .Values.config.mountTLS .Values.ingress.tls) }}
        - name: tls-secret
          secret:
            secretName: {{ (index .Values.ingress.tls 0).secretName }}
        {{- end }}
        - name: ca-config
          configMap:
            name: {{ include "hlf-ca.fullname" . }}--config    
      initContainers:
        - name: wait-for-db
          image: jwilder/dockerize
          imagePullPolicy: IfNotPresent 
          envFrom:
            - configMapRef:
                name: {{ include "hlf-ca.fullname" . }}--db
          command: 
            - sh
            - -c
            - |
              if [ -n "$DB_TYPE" ]; then
                dockerize -wait tcp://$DB_HOST:$DB_PORT -timeout 30s && echo "Database $DB_TYPE on $DB_HOST:$DB_PORT is ready"
              fi
      containers:
        - name: ca
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command:
            - sh
            - -c
            - |
              if [ -n "$DB_TYPE" ]; then
                while [ -z ${DB_PASSWORD+x} ];
                do
                  echo "\033[0;31mDB_PASSWORD environmental variable must contain a value \033[0m"
                  sleep 60
                done

                case "$DB_TYPE" in
                  postgres)
                    export DB_DATASOURCE="host=${DB_HOST} port=${DB_PORT} user=${DB_USERNAME} password=${DB_PASSWORD} dbname=${DB_DATABASE} sslmode=${DB_SSL}";;
                  mysql)
                    export DB_DATASOURCE="${DB_USERNAME}:${DB_PASSWORD}@tcp(${DB_HOST}:${DB_PORT})/${DB_DATABASE}?parseTime=true" ;;
                  *)
                    echo "\033[0;31m Database type '$DB_TYPE' not supported\033[0m"; exit 1;;
                esac
              fi

              mkdir -p $FABRIC_CA_HOME
              cp /var/hyperledger/ca_config/ca.yaml $FABRIC_CA_HOME/fabric-ca-server-config.yaml
              sed -i "s|<<<ADMIN>>>|${CA_ADMIN}|g" ${FABRIC_CA_HOME}/fabric-ca-server-config.yaml
              sed -i "s|<<<ADMINPW>>>|${CA_PASSWORD}|g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml
              sed -i "s|<<<DB_TYPE>>>|${DB_TYPE:-"sqlite3"}|g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml
              sed -i "s|<<<DB_DATASOURCE>>>|${DB_DATASOURCE:-"fabric-ca-server.db"}|g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml

              {{- if .Values.config.intermediate }}
              echo ">\033[0;33m Adding Parent CA (typically a Root CA) values to $FABRIC_CA_HOME/fabric-ca-server-config.yaml\033[0m"
              sed -i "s|<<<PARENT_ADMIN>>>|${PARENT_CA_ADMIN}|g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml
              sed -i "s|<<<PARENT_ADMINPW>>>|${PARENT_CA_PASSWORD}|g" $FABRIC_CA_HOME/fabric-ca-server-config.yaml
              {{- end}}

              echo ">\033[0;35m fabric-ca-server start \033[0m"
              fabric-ca-server start
          envFrom:
            - secretRef:
                name: {{ include "hlf-ca.fullname" . }}--ca
            - configMapRef:
                name: {{ include "hlf-ca.fullname" . }}--db
            - configMapRef:
                name: {{ include "hlf-ca.fullname" . }}--ca
          env:
            {{- if .Values.postgresql.enabled}}
            # PostgreSQL Database
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ template "postgresql.fullname" . }}
                  key: postgresql-password
            {{- end }}
            {{- if .Values.mysql.enabled }}
            # MySQL Database
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ template "mysql.fullname" . }}
                  key: mysql-password
            {{- end }}
            {{- if .Values.externalDatabase.type }}
            # External Database
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ include "hlf-ca.fullname" . }}--db
                  key: db-password
            {{- end }}            
            {{- if .Values.config.intermediate }}
            # Intermediate CA
            - name: PARENT_CA_ADMIN
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.config.intermediate.parent.chart }}--ca
                  key: CA_ADMIN
            - name: PARENT_CA_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.config.intermediate.parent.chart }}--ca
                  key: CA_PASSWORD
            {{- end}}
          ports:
            - name: ca-port
              containerPort: 7054
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /cainfo
              port: 7054
          readinessProbe:
            httpGet:
              path: /cainfo
              port: 7054             
          volumeMounts:
            - name: data
              mountPath: /var/hyperledger
            - name: ca-config
              readOnly: true
              mountPath: /var/hyperledger/ca_config
            {{- if (and .Values.config.mountTLS .Values.ingress.tls) }}
            - name: tls-secret
              readOnly: true
              mountPath: /var/hyperledger/tls/secret
            {{- end }}
          resources:
{{ toYaml .Values.resources | indent 12 }}
    {{- with .Values.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
    {{- end }}
