{{- if semverCompare "^1.9-0" .Capabilities.KubeVersion.GitVersion }}
apiVersion: apps/v1
{{- else }}
apiVersion: apps/v1beta1
{{- end }}
kind: Deployment
metadata:
  name: {{ template "traefik.fullname" . }}
  labels:
    app: {{ template "traefik.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  replicas: {{ default 1 .Values.replicas }}
  selector:
    matchLabels:
      app: {{ template "traefik.name" . }}
      release: {{ .Release.Name }}
  {{- if .Values.deploymentStrategy }}
  strategy:
{{ toYaml .Values.deploymentStrategy | indent 4 }}
  {{- end }}
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
      {{- if and (.Values.tolerations) (semverCompare "<1.6-0" .Capabilities.KubeVersion.GitVersion) }}
        scheduler.alpha.kubernetes.io/tolerations: '{{ toJson .Values.tolerations }}'
      {{- end }}
      {{- range $key, $value := .Values.deployment.podAnnotations }}
        {{ $key }}: {{ $value | quote }}
      {{- end }}
      labels:
        app: {{ template "traefik.name" . }}
        chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
        release: "{{ .Release.Name }}"
        heritage: "{{ .Release.Service }}"
    spec:
      {{- if .Values.rbac.enabled }}
      serviceAccountName: {{ template "traefik.fullname" . }}
      {{- else }}
      serviceAccountName: default
      {{- end }}
      terminationGracePeriodSeconds: 60
      {{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
      {{- end }}
      {{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
      {{- end }}
      containers:
      - image: {{ .Values.image }}:{{ .Values.imageTag }}
        name: {{ template "traefik.fullname" . }}
        resources:
          requests:
            cpu: "{{ .Values.cpuRequest }}"
            memory: "{{ .Values.memoryRequest }}"
          limits:
            cpu: "{{ .Values.cpuLimit }}"
            memory: "{{ .Values.memoryLimit }}"
        readinessProbe:
          tcpSocket:
            port: 80
          failureThreshold: 1
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 2
        livenessProbe:
          tcpSocket:
            port: 80
          failureThreshold: 3
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 2
        {{- if and .Values.acme.enabled (eq .Values.acme.challengeType "dns-01") .Values.acme.dnsProvider.name }}
        env:
        {{- range $k, $_ := (index .Values.acme.dnsProvider .Values.acme.dnsProvider.name) }}
          - name: {{ $k }}
            valueFrom:
              secretKeyRef:
                name: {{ template "traefik.fullname" $ }}-dnsprovider-config
                key: {{ $k }}
        {{- end }}
        {{- end }}
        volumeMounts:
        - mountPath: /config
          name: config
        {{- if and .Values.ssl.enabled (not .Values.ssl.upstream) }}
        - mountPath: /ssl
          name: ssl
        {{- end }}
        {{- if .Values.acme.enabled }}
        - mountPath: /acme
          name: acme
        {{- end }}
        ports:
        - name: http
          containerPort: 80
          {{- if .Values.deployment.hostPort.httpEnabled }}
          hostPort: 80
          {{- end }}
          protocol: TCP
        - name: httpn
          containerPort: 8880
          protocol: TCP
        - name: https
          containerPort: 443
          {{- if .Values.deployment.hostPort.httpsEnabled }}
          hostPort: 443
          {{- end }}
          protocol: TCP
        {{- if .Values.dashboard.enabled }}
        - name: dash
          containerPort: 8080
          {{- if .Values.deployment.hostPort.dashboardEnabled }}
          hostPort: 8080
          {{- end }}
          protocol: TCP
        {{- end }}
        args:
        - --configfile=/config/traefik.toml
      volumes:
      - name: config
        configMap:
          name: {{ template "traefik.fullname" . }}
      {{- if and .Values.ssl.enabled (not .Values.ssl.upstream) }}
      - name: ssl
        secret:
          secretName: {{ template "traefik.fullname" . }}-default-cert
      {{- end }}
      {{- if .Values.acme.enabled }}
      - name: acme
      {{- if .Values.acme.persistence.enabled }}
        persistentVolumeClaim:
          claimName: {{ .Values.acme.persistence.existingClaim | default (printf "%s-acme" (include "traefik.fullname" .)) }}
      {{- else }}
        emptyDir: {}
      {{- end }}
      {{- end }}
      {{- if and (.Values.tolerations) (semverCompare "^1.6-0" .Capabilities.KubeVersion.GitVersion) }}
      tolerations:
{{ toYaml .Values.tolerations | indent 6 }}
      {{- end }}
