apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ template "spinnaker.fullname" . }}-halyard
  labels:
{{ include "spinnaker.standard-labels" . | indent 4 }}
spec:
  serviceName: {{ template "spinnaker.fullname" . }}-halyard
  replicas: 1
  selector:
    matchLabels:
{{ include "spinnaker.standard-selector-labels" . | indent 6 }}
      component: halyard
  template:
    metadata:
      labels:
{{ include "spinnaker.standard-labels" . | indent 8 }}
        component: halyard
    spec:
      {{- if .Values.serviceAccount.halyardName }}
      serviceAccountName: {{ .Values.serviceAccount.halyardName }}
      {{- else }}
      serviceAccountName: {{ template "spinnaker.fullname" . }}-halyard
      {{- end }}
      securityContext:
        runAsUser: 1000
        fsGroup: 1000
      initContainers:
      - name: "create-halyard-local"
        image: {{ .Values.halyard.image.repository }}:{{ .Values.halyard.image.tag }}
        command:
        - bash
        - -c
        - |
          # Override Halyard daemon's listen address
          cp /opt/halyard/config/* /tmp/config && \
          printf 'server.address: 0.0.0.0\n' > /tmp/config/halyard-local.yml && \
          # Use Redis deployed via the dependent Helm chart
          mkdir -p /tmp/spinnaker/.hal/default/service-settings && \
          printf 'overrideBaseUrl: redis://:{{ .Values.redis.password }}@{{ .Release.Name }}-redis-master:6379\nskipLifeCycleManagement: true\n' > /tmp/spinnaker/.hal/default/service-settings/redis.yml && \
          # Route the /gate path of Deck to Gate
          printf 'env:\n  API_HOST: http://spin-gate.{{ .Release.Namespace }}:8084/\n' > /tmp/spinnaker/.hal/default/service-settings/deck.yml
        volumeMounts:
        - name: halyard-config
          mountPath: /tmp/config
        - name: halyard-home
          mountPath: /tmp/spinnaker
      volumes:
      {{- if .Values.kubeConfig.enabled }}
      - name: kube-config
        secret:
          secretName: {{ .Values.kubeConfig.secretName }}
      {{- end }}
      {{- if .Values.gcs.enabled }}
      - name: gcs-key
        secret:
          secretName: {{ template "spinnaker.fullname" . }}-gcs
      {{- end }}
      - name: reg-secrets
        secret:
          {{- if .Values.dockerRegistryAccountSecret }}
          secretName: {{ .Values.dockerRegistryAccountSecret }}
          {{- else }}
          secretName: {{ template "spinnaker.fullname" .}}-registry
          {{- end }}
      {{- if and .Values.s3.enabled .Values.s3.accessKey .Values.s3.secretKey }}
      - name: s3-secrets
        secret:
          secretName: {{ template "spinnaker.fullname" . }}-s3
      {{- end }}
      - name: halyard-config
        emptyDir: {}
      containers:
      - name: halyard
        image: {{ .Values.halyard.image.repository }}:{{ .Values.halyard.image.tag }}
        ports:
        - containerPort: 8064
          name: daemon
        volumeMounts:
        {{- if .Values.gcs.enabled }}
        - name: gcs-key
          mountPath: /opt/gcs
        {{- end }}
        {{- if and .Values.s3.enabled .Values.s3.accessKey .Values.s3.secretKey }}
        - name: s3-secrets
          mountPath: /opt/s3
        {{- end }}
        {{- if .Values.kubeConfig.enabled }}
        - name: kube-config
          mountPath: /opt/kube
        {{- end }}
        - name: halyard-home
          mountPath: /home/spinnaker
        - name: halyard-config
          mountPath: /opt/halyard/config
        - name: reg-secrets
          mountPath: /opt/registry/passwords
  volumeClaimTemplates:
  - metadata:
      name: halyard-home
      labels:
{{ include "spinnaker.standard-labels" . | indent 8 }}
    spec:
      accessModes: [ "ReadWriteOnce" ]
      resources:
        requests:
          storage: 10Gi
