{{/*
Deployment for the gitops-status-server
Runs nginx-unprivileged to serve the status.json file
*/}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "gitops-status-server.fullname" . }}
  labels:
    {{- include "gitops-status-server.labels" . | nindent 4 }}
  {{- with .Values.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "gitops-status-server.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      annotations:
        # Automatically roll deployment when ConfigMap changes
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        {{- with .Values.podAnnotations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      labels:
        {{- include "gitops-status-server.selectorLabels" . | nindent 8 }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "gitops-status-server.serviceAccountName" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
      - name: nginx
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        securityContext:
          {{- toYaml .Values.securityContext | nindent 10 }}
        ports:
        - name: http
          containerPort: {{ .Values.service.targetPort }}
          protocol: TCP
        # Health checks
        livenessProbe:
          httpGet:
            path: /status.json
            port: http
          initialDelaySeconds: 5
          periodSeconds: 10
          timeoutSeconds: 3
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /status.json
            port: http
          initialDelaySeconds: 2
          periodSeconds: 5
          timeoutSeconds: 2
          failureThreshold: 2
        resources:
          {{- toYaml .Values.resources | nindent 10 }}
        volumeMounts:
        # Mount the status.json file from ConfigMap
        # We mount it as a subPath to avoid overwriting the entire directory
        - name: status-json
          mountPath: /usr/share/nginx/html/status.json
          subPath: status.json
          readOnly: true
        # nginx-unprivileged needs writable directories for cache and run
        - name: cache
          mountPath: /var/cache/nginx
        - name: run
          mountPath: /var/run
      volumes:
      # ConfigMap volume containing the status.json
      - name: status-json
        configMap:
          name: {{ include "gitops-status-server.fullname" . }}
          items:
          - key: status.json
            path: status.json
      # Empty directories for nginx runtime
      - name: cache
        emptyDir: {}
      - name: run
        emptyDir: {}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}