apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: "{{ template "core.fullname" . }}"
  labels:
    app: "{{ template "fullname" . }}"
    component: core
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  replicas: {{ .Values.coreConfig.replicaCount }}
  template:
    metadata:
      labels:
        app: "{{ template "fullname" . }}"
        component: core
    spec:
      volumes:
        - name: config-volume
          configMap:
            name: {{ template "core.fullname" .}}
        {{- if .Values.globalConfig.internalServicesSslEnabled }}
        - name: certs
          secret:
            secretName: {{ .Values.coreConfig.ssl.certSecret }}
        {{- end }}
      containers:
      - name: {{ .Chart.Name }}-core
        image: {{ .Values.image.tag }}
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        ports:
        - containerPort: {{ .Values.service.ports.api }}
          name: external-api
        - containerPort: {{ .Values.service.ports.queue }}
          name: queue-service
        - containerPort: {{ .Values.service.ports.k8sImagePolicyWebhook }}
          name: webhook-service
        - containerPort: {{ .Values.service.ports.catalog }}
          name: catalog
        - containerPort: {{ .Values.service.ports.policy }}
          name: policy-engine
        env:
        - name: ANCHORE_DB
          value: {{ .Values.postgresql.postgresDatabase }}
        - name: ANCHORE_DB_HOST
          value: {{ template "postgres.fullname" . }}
        - name: ANCHORE_IO_USER
          valueFrom:
            secretKeyRef:
              name: {{ template "fullname" . }}
              key: anchoreIOUser
        - name: ANCHORE_IO_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ template "fullname" . }}
              key: anchoreIOPassword
        - name: ANCHORE_DB_USER
          valueFrom:
            secretKeyRef:
              name: {{ template "fullname" . }}
              key: dbUser
        - name: ANCHORE_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ template "fullname" . }}
              key: dbPassword
        - name: ANCHORE_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ template "fullname" . }}
              key: adminPassword
        - name: ANCHORE_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: ANCHORE_POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: ANCHORE_POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        volumeMounts:
        - name: config-volume
          mountPath: /config
        {{- if .Values.globalConfig.internalServicesSslEnabled }}
        - name: certs
          mountPath: {{ default "/certs" .Values.coreConfig.ssl.certDir }}
          readOnly: true
        {{- end }}
        readinessProbe:
          httpGet:
            path: /health
            port: external-api
          initialDelaySeconds: 60
          periodSeconds: 10
          timeoutSeconds: 10
          failureThreshold: 10
        livenessProbe:
          httpGet:
            path: /health
            port: external-api
          timeoutSeconds: 10
          initialDelaySeconds: 60
          periodSeconds: 30
          failureThreshold: 10
        resources:
{{ toYaml .Values.coreConfig.resources | indent 10 }}
    {{- if .Values.coreConfig.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.coreConfig.nodeSelector | indent 8 }}
    {{- end }}
    {{- with .Values.coreConfig.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.coreConfig.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
    {{- end }}
