{{- $ctx := dict "helm" . "noEnterprise" true }}
{{- $fullname := include "vm.plain.fullname" $ctx }}
{{- $ns := include "vm.namespace" $ctx }}
{{- $env := dict -}}
{{- range .Values.env | default list -}}
  {{- $_ := set $env .name .value -}}
{{- end -}}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $fullname }}
  namespace: {{ $ns }}
  {{- $_ := set $ctx "extraLabels" .Values.extraLabels }}
  labels: {{ include "vm.labels" $ctx | nindent 4 }}
  {{- $_ := unset $ctx "extraLabels" }}
  {{- with .Values.annotations }}
  annotations: {{ toYaml . | nindent 4 }}
  {{- end }}
spec:
  replicas: {{.Values.replicaCount }}
  selector:
    matchLabels: {{ include "vm.selectorLabels" $ctx | nindent 6 }}
  template:
    metadata:
      {{- with .Values.annotations }}
      annotations: {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- $_ := set $ctx "extraLabels" .Values.podLabels }}
      labels: {{ include "vm.podLabels" $ctx | nindent 8 }}
      {{- $_ := unset $ctx "extraLabels" }}
    spec:
      automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
      {{- if .Values.podSecurityContext.enabled }}
      securityContext: {{ include "vm.securityContext" (dict "securityContext" .Values.podSecurityContext "helm" .) | nindent 8 }}
      {{- end }}
      {{- if .Values.hostNetwork }}
      hostNetwork: true
      {{- end }}
      {{- if .Values.shareProcessNamespace }}
      shareProcessNamespace: true
      {{- end }}
      {{- if or (.Values.serviceAccount).name (.Values.serviceAccount).create }}
      serviceAccountName: {{ (.Values.serviceAccount).name | default $fullname }}
      {{- end }}
      {{- with (.Values.imagePullSecrets | default .Values.global.imagePullSecrets) }}
      imagePullSecrets: {{ toYaml . | nindent 8 }}
      {{- end }}
      containers:
        - name: operator
          image: {{ include "vm.image" $ctx }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          {{- with .Values.envFrom }}
          envFrom: {{ toYaml . | nindent 12 }}
          {{- end }}
          env:
            {{- range .Values.env }}
            - name: {{ .name }}
              value: {{ .value | quote }}
            {{- end }}
            {{- if .Values.watchNamespaces }}
            - name: WATCH_NAMESPACE
              value: {{ (tpl (.Values.watchNamespaces | join ",") .) | quote }}
            {{- end }}
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: {{ .Chart.Name }}
            {{- with (((.Values).global).image).registry }}
            - name: VM_CONTAINERREGISTRY
              value: {{ quote . }}
            {{- end -}}
            {{- if not (empty (.Values.configReloader).image) }}
            - name: VM_CONFIG_RELOADER_IMAGE
              {{- $_ := set $ctx "appKey" (list "configReloader") }}
              value: {{ include "vm.image" $ctx }}
              {{- $_ := unset $ctx "appKey" }}
            {{- end }}
            {{- if .Values.operator.disable_prometheus_converter }}
            - name: VM_ENABLEDPROMETHEUSCONVERTER_PODMONITOR
              value: "false"
            - name: VM_ENABLEDPROMETHEUSCONVERTER_SERVICESCRAPE
              value: "false"
            - name: VM_ENABLEDPROMETHEUSCONVERTER_PROMETHEUSRULE
              value: "false"
            - name: VM_ENABLEDPROMETHEUSCONVERTER_PROBE
              value: "false"
            - name: VM_ENABLEDPROMETHEUSCONVERTER_ALERTMANAGERCONFIG
              value: "false"
            {{- else if .Values.operator.prometheus_converter_add_argocd_ignore_annotations }}
            - name: VM_PROMETHEUSCONVERTERADDARGOCDIGNOREANNOTATIONS
              value: "true"
            {{- end }}
            - name: VM_ENABLEDPROMETHEUSCONVERTEROWNERREFERENCES
              value: {{ .Values.operator.enable_converter_ownership | quote}}
          args:
            - --zap-log-level={{ .Values.logLevel }}
            - --leader-elect
            - --health-probe-bind-address=:8081
            {{- if .Values.admissionWebhooks.enabled }}
            - --webhook.enable=true
            {{- end }}
            {{- range $key, $value := .Values.extraArgs }}
            {{- if kindIs "slice" $value }}
            {{- range $v := $value }}
            - --{{ $key }}={{ $v }}
            {{- end }}
            {{- else }}
            - --{{ $key }}={{ $value }}
            {{- end }}
            {{- end }}
          ports:
            - name: http
              containerPort: {{ include "vm.port.from.flag" (dict "flag" (index .Values.extraArgs "metrics-bind-address") "default" "8080") }}
              protocol: TCP
            - name: probe
              containerPort: {{ include "vm.port.from.flag" (dict "flag" (index .Values.extraArgs "health-probe-bind-address") "default" "8081") }}
              protocol: TCP
            - name: webhook
              containerPort: {{ include "vm.port.from.flag" (dict "flag" (index .Values.extraArgs "webhook.port") "default" "9443") }}
              protocol: TCP
          {{- with (fromYaml (include "vm.probe" (dict "app" .Values "type" "readiness"))) }}
          readinessProbe: {{ toYaml . | nindent 12 }}
          {{- end }}
          {{- with (fromYaml (include "vm.probe" (dict "app" .Values "type" "liveness"))) }}
          livenessProbe: {{ toYaml . | nindent 12 }}
          {{- end }}
          {{- with (fromYaml (include "vm.probe" (dict "app" .Values "type" "startup"))) }}
          startupProbe: {{ toYaml . | nindent 12 }}
          {{- end }}
          volumeMounts:
            {{- if .Values.admissionWebhooks.enabled }}
            - mountPath: /tmp/k8s-webhook-server/serving-certs
              name: cert
              readOnly: true
            {{- end }}
            {{- with .Values.extraVolumeMounts }}
            {{- toYaml . | nindent 12 }}
            {{- end }}
          resources: {{ toYaml .Values.resources | nindent 12 }}
          {{- if .Values.securityContext.enabled }}
          securityContext: {{ include "vm.securityContext" (dict "securityContext" .Values.securityContext "helm" .) | nindent 12 }}
          {{- end }}
        {{- with.Values.extraContainers }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector: {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.priorityClassName }}
      priorityClassName: {{ . }}
      {{- end }}
      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
      {{- with .Values.lifecycle }}
      lifecycle: {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity: {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- if .Values.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- range $constraint := .Values.topologySpreadConstraints }}
        - {{ toYaml $constraint | nindent 10 | trim }}
          {{- if not $constraint.labelSelector }}
          labelSelector:
            matchLabels: {{ include "vm.selectorLabels" $ctx | nindent 14 }}
          {{- end }}
        {{- end }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations: {{ toYaml . | nindent 8 }}
      {{- end }}
      volumes:
        {{- if .Values.admissionWebhooks.enabled }}
        - name: cert
          secret:
            defaultMode: 420
            secretName: {{ $fullname }}-validation
        {{- end }}
        {{- with .Values.extraVolumes }}
        {{- toYaml .| nindent 8 }}
        {{- end }}
