{{/*
 Licensed to the Apache Software Foundation (ASF) under one
 or more contributor license agreements.  See the NOTICE file
 distributed with this work for additional information
 regarding copyright ownership.  The ASF licenses this file
 to you under the Apache License, Version 2.0 (the
 "License"); you may not use this file except in compliance
 with the License.  You may obtain a copy of the License at

   http://www.apache.org/licenses/LICENSE-2.0

 Unless required by applicable law or agreed to in writing,
 software distributed under the License is distributed on an
 "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 KIND, either express or implied.  See the License for the
 specific language governing permissions and limitations
 under the License.
*/}}
---
{{- $nodeSelector := or .Values.workers.kubernetes.nodeSelector .Values.workers.nodeSelector .Values.nodeSelector }}
{{- $affinity := or .Values.workers.kubernetes.affinity .Values.workers.affinity .Values.affinity }}
{{- $tolerations := or .Values.workers.kubernetes.tolerations .Values.workers.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.workers.kubernetes.topologySpreadConstraints .Values.workers.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.workers.kubernetes .Values.workers .Values) }}
{{- $containerSecurityContextKerberosSidecar := include "containerSecurityContext" (list .Values.workers.kubernetes.kerberosSidecar .Values.workers.kerberosSidecar .Values) }}
{{- $containerLifecycleHooksKerberosSidecar := or .Values.workers.kubernetes.kerberosSidecar.containerLifecycleHooks .Values.workers.kerberosSidecar.containerLifecycleHooks .Values.containerLifecycleHooks }}
{{- $containerSecurityContextKerberosInitContainer := include "containerSecurityContext" (list .Values.workers.kubernetes.kerberosInitContainer .Values.workers.kerberosInitContainer .Values) }}
{{- $containerLifecycleHooksKerberosInitContainer := or .Values.workers.kubernetes.kerberosInitContainer.containerLifecycleHooks .Values.workers.kerberosInitContainer.containerLifecycleHooks .Values.containerLifecycleHooks }}
{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.workers.kubernetes .Values.workers .Values) }}
{{- $containerLifecycleHooks := or .Values.workers.kubernetes.containerLifecycleHooks .Values.workers.containerLifecycleHooks .Values.containerLifecycleHooks }}
{{- $safeToEvict := dict "cluster-autoscaler.kubernetes.io/safe-to-evict" (or .Values.workers.kubernetes.safeToEvict (and (not (has .Values.workers.kubernetes.safeToEvict (list true false))) .Values.workers.safeToEvict) | toString) }}
{{- $podAnnotations := mergeOverwrite (deepCopy .Values.airflowPodAnnotations) $safeToEvict (.Values.workers.kubernetes.podAnnotations | default .Values.workers.podAnnotations) }}
{{- $schedulerName := or .Values.workers.kubernetes.schedulerName .Values.workers.schedulerName .Values.schedulerName }}
apiVersion: v1
kind: Pod
metadata:
  name: placeholder-name
  labels:
    tier: airflow
    component: worker
    release: {{ .Release.Name }}
    {{- if or .Values.labels .Values.workers.labels .Values.workers.kubernetes.labels }}
      {{- mustMerge (.Values.workers.kubernetes.labels | default .Values.workers.labels) .Values.labels | toYaml | nindent 4 }}
    {{- end }}
  annotations:
    {{- tpl (toYaml $podAnnotations) . | nindent 4 }}
    {{- if or .Values.workers.kubernetes.kerberosInitContainer.enabled .Values.workers.kerberosInitContainer.enabled }}
    checksum/kerberos-keytab: {{ include (print $.Template.BasePath "/secrets/kerberos-keytab-secret.yaml") . | sha256sum }}
    {{- end }}
spec:
  initContainers:
    {{- if and .Values.dags.gitSync.enabled (not .Values.dags.persistence.enabled) }}
      {{- include "git_sync_container" (dict "Values" .Values "is_init" "true" "Template" .Template) | nindent 4 }}
    {{- end }}
    {{- if or .Values.workers.kubernetes.extraInitContainers .Values.workers.extraInitContainers }}
      {{- tpl (toYaml (.Values.workers.kubernetes.extraInitContainers | default .Values.workers.extraInitContainers)) . | nindent 4 }}
    {{- end }}
    {{- if or .Values.workers.kubernetes.kerberosInitContainer.enabled .Values.workers.kerberosInitContainer.enabled }}
    - name: kerberos-init
      image: {{ template "airflow_image" . }}
      imagePullPolicy: {{ .Values.images.airflow.pullPolicy }}
      securityContext: {{ $containerSecurityContextKerberosInitContainer | nindent 8 }}
      {{- if $containerLifecycleHooksKerberosInitContainer }}
      lifecycle: {{- tpl (toYaml $containerLifecycleHooksKerberosInitContainer) . | nindent 8 }}
      {{- end }}
      args: ["kerberos", "-o"]
      resources: {{- toYaml (.Values.workers.kubernetes.kerberosInitContainer.resources | default .Values.workers.kerberosInitContainer.resources) | nindent 8 }}
      volumeMounts:
        - name: logs
          mountPath: {{ template "airflow_logs" . }}
          {{- if .Values.logs.persistence.subPath }}
          subPath: {{ .Values.logs.persistence.subPath }}
          {{- end }}
        {{- include "airflow_config_mount" . | nindent 8 }}
        - name: config
          mountPath: {{ .Values.kerberos.configPath | quote }}
          subPath: krb5.conf
          readOnly: true
        - name: kerberos-keytab
          subPath: "kerberos.keytab"
          mountPath: {{ .Values.kerberos.keytabPath | quote }}
          readOnly: true
        - name: kerberos-ccache
          mountPath: {{ .Values.kerberos.ccacheMountPath | quote }}
          readOnly: false
        {{- if .Values.volumeMounts }}
          {{- toYaml .Values.volumeMounts | nindent 8 }}
        {{- end }}
        {{- if or .Values.workers.extraVolumeMounts .Values.workers.kubernetes.extraVolumeMounts }}
          {{- tpl (toYaml (.Values.workers.kubernetes.extraVolumeMounts | default .Values.workers.extraVolumeMounts)) . | nindent 8 }}
        {{- end }}
        {{- if semverCompare ">=3.0.0" .Values.airflowVersion }}
          {{- if or .Values.apiServer.apiServerConfig .Values.apiServer.apiServerConfigConfigMapName }}
            {{- include "airflow_api_server_config_mount" . | nindent 8 }}
          {{- end }}
        {{- else }}
          {{- if or .Values.webserver.webserverConfig .Values.webserver.webserverConfigConfigMapName }}
            {{- include "airflow_webserver_config_mount" . | nindent 8 }}
          {{- end }}
        {{- end }}
      envFrom: {{- include "custom_airflow_environment_from" . | default "\n  []" | indent 6 }}
      env:
        - name: KRB5_CONFIG
          value:  {{ .Values.kerberos.configPath | quote }}
        - name: KRB5CCNAME
          value:  {{ include "kerberos_ccache_path" . | quote }}
        {{- include "custom_airflow_environment" . | indent 6 }}
        {{- include "standard_airflow_environment" . | indent 6 }}
    {{- end }}
  containers:
    - envFrom: {{- include "custom_airflow_environment_from" . | default "\n  []" | indent 6 }}
      env:
        - name: AIRFLOW__CORE__EXECUTOR
          value: {{ .Values.executor | quote }}
        {{- if or .Values.workers.kubernetes.kerberosSidecar.enabled .Values.workers.kerberosSidecar.enabled .Values.workers.kubernetes.kerberosInitContainer.enabled .Values.workers.kerberosInitContainer.enabled }}
        - name: KRB5_CONFIG
          value:  {{ .Values.kerberos.configPath | quote }}
        - name: KRB5CCNAME
          value:  {{ include "kerberos_ccache_path" . | quote }}
        {{- end }}
        {{- include "standard_airflow_environment" . | indent 6}}
        {{- include "custom_airflow_environment" . | indent 6 }}
        {{- include "container_extra_envs" (list . (.Values.workers.kubernetes.env | default .Values.workers.env)) | indent 6 }}
      image: {{ template "pod_template_image" . }}
      imagePullPolicy: {{ .Values.images.pod_template.pullPolicy }}
      securityContext: {{ $containerSecurityContext | nindent 8 }}
      {{- if $containerLifecycleHooks }}
      lifecycle: {{- tpl (toYaml $containerLifecycleHooks) . | nindent 8 }}
      {{- end }}
      name: base
      {{- if or .Values.workers.kubernetes.command .Values.workers.command }}
      command: {{ tpl (toYaml (.Values.workers.kubernetes.command | default .Values.workers.command)) . | nindent 8 }}
      {{- end }}
      resources: {{- toYaml (.Values.workers.kubernetes.resources | default .Values.workers.resources) | nindent 8 }}
      volumeMounts:
        - mountPath: {{ template "airflow_logs" . }}
          name: logs
          {{- if .Values.logs.persistence.subPath }}
          subPath: {{ .Values.logs.persistence.subPath }}
          {{- end }}
        {{- include "airflow_config_mount" . | nindent 8 }}
        {{- if or .Values.dags.gitSync.enabled .Values.dags.persistence.enabled }}
          {{- include "airflow_dags_mount" . | nindent 8 }}
        {{- end }}
        {{- if .Values.volumeMounts }}
          {{- toYaml .Values.volumeMounts | nindent 8 }}
        {{- end }}
        {{- if or .Values.workers.extraVolumeMounts .Values.workers.kubernetes.extraVolumeMounts }}
          {{- tpl (toYaml (.Values.workers.kubernetes.extraVolumeMounts | default .Values.workers.extraVolumeMounts)) . | nindent 8 }}
        {{- end }}
        {{- if .Values.kerberos.enabled }}
        - name: kerberos-keytab
          subPath: "kerberos.keytab"
          mountPath: {{ .Values.kerberos.keytabPath | quote }}
          readOnly: true
        - name: config
          mountPath: {{ .Values.kerberos.configPath | quote }}
          subPath: krb5.conf
          readOnly: true
        - name: kerberos-ccache
          mountPath: {{ .Values.kerberos.ccacheMountPath | quote }}
          readOnly: true
        {{- end }}
    {{- if or .Values.workers.kubernetes.kerberosSidecar.enabled .Values.workers.kerberosSidecar.enabled }}
    - name: worker-kerberos
      image: {{ template "airflow_image" . }}
      imagePullPolicy: {{ .Values.images.airflow.pullPolicy }}
      securityContext: {{ $containerSecurityContextKerberosSidecar | nindent 8 }}
      {{- if $containerLifecycleHooksKerberosSidecar }}
      lifecycle: {{- tpl (toYaml $containerLifecycleHooksKerberosSidecar) . | nindent 8 }}
      {{- end }}
      args: ["kerberos"]
      resources: {{- toYaml (.Values.workers.kubernetes.kerberosSidecar.resources | default .Values.workers.kerberosSidecar.resources) | nindent 8 }}
      volumeMounts:
        - name: logs
          mountPath: {{ template "airflow_logs" . }}
          {{- if .Values.logs.persistence.subPath }}
          subPath: {{ .Values.logs.persistence.subPath }}
          {{- end }}
        {{- include "airflow_config_mount" . | nindent 8 }}
        - name: config
          mountPath: {{ .Values.kerberos.configPath | quote }}
          subPath: krb5.conf
          readOnly: true
        - name: kerberos-keytab
          subPath: "kerberos.keytab"
          mountPath: {{ .Values.kerberos.keytabPath | quote }}
          readOnly: true
        - name: kerberos-ccache
          mountPath: {{ .Values.kerberos.ccacheMountPath | quote }}
          readOnly: false
        {{- if .Values.volumeMounts }}
          {{- toYaml .Values.volumeMounts | nindent 8 }}
        {{- end }}
        {{- if or .Values.workers.extraVolumeMounts .Values.workers.kubernetes.extraVolumeMounts }}
          {{- tpl (toYaml (.Values.workers.kubernetes.extraVolumeMounts | default .Values.workers.extraVolumeMounts)) . | nindent 8 }}
        {{- end }}
        {{- if semverCompare ">=3.0.0" .Values.airflowVersion }}
          {{- if or .Values.apiServer.apiServerConfig .Values.apiServer.apiServerConfigConfigMapName }}
            {{- include "airflow_api_server_config_mount" . | nindent 8 }}
          {{- end }}
        {{- else }}
          {{- if or .Values.webserver.webserverConfig .Values.webserver.webserverConfigConfigMapName }}
            {{- include "airflow_webserver_config_mount" . | nindent 8 }}
          {{- end }}
        {{- end }}
      envFrom: {{- include "custom_airflow_environment_from" . | default "\n  []" | indent 6 }}
      env:
        - name: KRB5_CONFIG
          value:  {{ .Values.kerberos.configPath | quote }}
        - name: KRB5CCNAME
          value:  {{ include "kerberos_ccache_path" . | quote }}
        {{- include "custom_airflow_environment" . | indent 6 }}
        {{- include "standard_airflow_environment" . | indent 6 }}
    {{- end }}
    {{- if or .Values.workers.kubernetes.extraContainers .Values.workers.extraContainers }}
      {{- tpl (toYaml (.Values.workers.kubernetes.extraContainers | default .Values.workers.extraContainers)) . | nindent 4 }}
    {{- end }}
  {{- if or .Values.workers.kubernetes.priorityClassName .Values.workers.priorityClassName }}
  priorityClassName: {{ .Values.workers.kubernetes.priorityClassName | default .Values.workers.priorityClassName }}
  {{- end }}
  {{- if or .Values.workers.kubernetes.runtimeClassName .Values.workers.runtimeClassName }}
  runtimeClassName: {{ .Values.workers.kubernetes.runtimeClassName | default .Values.workers.runtimeClassName }}
  {{- end }}
  imagePullSecrets: {{- include "image_pull_secrets" . | nindent 4 }}
  {{- if or .Values.workers.kubernetes.hostAliases .Values.workers.hostAliases }}
  hostAliases: {{- toYaml (.Values.workers.kubernetes.hostAliases | default .Values.workers.hostAliases) | nindent 4 }}
  {{- end }}
  restartPolicy: Never
  securityContext: {{ $securityContext | nindent 4 }}
  nodeSelector: {{- toYaml $nodeSelector | nindent 4 }}
  affinity: {{- toYaml $affinity | nindent 4 }}
  {{- if $schedulerName }}
  schedulerName: {{ $schedulerName }}
  {{- end }}
  terminationGracePeriodSeconds: {{ .Values.workers.kubernetes.terminationGracePeriodSeconds | default .Values.workers.terminationGracePeriodSeconds }}
  tolerations: {{- toYaml $tolerations | nindent 4 }}
  topologySpreadConstraints: {{- toYaml $topologySpreadConstraints | nindent 4 }}
  {{- if .Values.workers.kubernetes.serviceAccount.create }}
  serviceAccountName: {{ include "worker.kubernetes.serviceAccountName" . }}
  {{- else }}
  serviceAccountName: {{ include "worker.serviceAccountName" . }}
  {{- end }}
  volumes:
  {{- if .Values.dags.persistence.enabled }}
  - name: dags
    persistentVolumeClaim:
      claimName: {{ template "airflow_dags_volume_claim" . }}
  {{- else if .Values.dags.gitSync.enabled }}
  - name: dags
    emptyDir: {{- toYaml (default (dict) .Values.dags.gitSync.emptyDirConfig) | nindent 6 }}
  {{- end }}
  {{- if .Values.logs.persistence.enabled }}
  - name: logs
    persistentVolumeClaim:
      claimName: {{ template "airflow_logs_volume_claim" . }}
  {{- else }}
  - emptyDir: {{- toYaml (default (dict) .Values.logs.emptyDirConfig) | nindent 6 }}
    name: logs
  {{- end }}
  {{- if and  .Values.dags.gitSync.enabled (or .Values.dags.gitSync.sshKeySecret .Values.dags.gitSync.sshKey) }}
    {{- include "git_sync_ssh_key_volume" . | nindent 2 }}
  {{- end }}
  - configMap:
      name: {{ include "airflow_config" . }}
    name: config
  {{- if semverCompare ">=3.0.0" .Values.airflowVersion }}
    {{- if and (or .Values.apiServer.apiServerConfig .Values.apiServer.apiServerConfigConfigMapName) (or .Values.workers.kubernetes.kerberosInitContainer.enabled .Values.workers.kerberosInitContainer.enabled .Values.workers.kubernetes.kerberosSidecar.enabled .Values.workers.kerberosSidecar.enabled) }}
  - name: api-server-config
    configMap:
      name: {{ template "airflow_api_server_config_configmap_name" . }}
    {{- end }}
  {{- else }}
    {{- if and (or .Values.webserver.webserverConfig .Values.webserver.webserverConfigConfigMapName) (or .Values.workers.kubernetes.kerberosInitContainer.enabled .Values.workers.kerberosInitContainer.enabled .Values.workers.kubernetes.kerberosSidecar.enabled .Values.workers.kerberosSidecar.enabled) }}
  - name: webserver-config
    configMap:
      name: {{ template "airflow_webserver_config_configmap_name" . }}
    {{- end }}
  {{- end }}
  {{- if .Values.volumes }}
    {{- toYaml .Values.volumes | nindent 2 }}
  {{- end }}
  {{- if .Values.kerberos.enabled }}
  - name: kerberos-keytab
    secret:
      secretName: {{ include "kerberos_keytab_secret" . | quote }}
  - name: kerberos-ccache
    emptyDir: {}
  {{- end }}
  {{- if or .Values.workers.kubernetes.extraVolumes .Values.workers.extraVolumes }}
    {{- tpl (toYaml (.Values.workers.kubernetes.extraVolumes | default .Values.workers.extraVolumes)) . | nindent 2 }}
  {{- end }}