apiVersion: apps/v1
kind: Deployment
metadata:
  name: ml-pipeline-ui
spec:
  template:
    spec:
      securityContext:
        ## NOTE: this is important for AWS IRSA
        fsGroup: 65534
      containers:
        - name: ml-pipeline-ui
          readinessProbe:
            ## NOTE: we remove the readinessProbe because this Deployment has only 1 replica,
            ##       so there is never a case when we don't want to at least try and send traffic to the Pod,
            ##       also, the livenessProbe will restart the Pod if it becomes unhealthy,
            ##       and the startupProbe protects the Pod during startup
            $patch: delete
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
          startupProbe:
            failureThreshold: 10
            initialDelaySeconds: 15
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
            exec:
              command:
                - wget
                - -q
                - -S
                - -O
                - '-'
                - http://localhost:3000/apis/v1beta1/healthz
          env:
            ## ================================
            ## UserID Configs
            ## ================================
            - name: KUBEFLOW_USERID_HEADER
              value: null
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: USERID_HEADER
            - name: KUBEFLOW_USERID_PREFIX
              value: null
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: USERID_PREFIX

            ## ================================
            ## Minio - Object Store Configs
            ## ================================
            ## NOTE: we set both the S3 & Minio configs because we don't know what kind of object store the user is using
            - name: MINIO_NAMESPACE
              ## must be empty, or kubeflow pipelines will attempt to append the namespace to MINIO_HOST
              value: ""
            - name: MINIO_HOST
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: bucketHost
            - name: MINIO_PORT
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: bucketPort
            - name: MINIO_SSL
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: bucketSecure
            - name: MINIO_ACCESS_KEY
              {{<- if .Values.kubeflow_tools.pipelines.objectStore.auth.fromEnv >}}
              value: ""
              valueFrom:
                $patch: delete
              {{<- else >}}
              valueFrom:
                secretKeyRef:
                  name: {{< tmpl.Exec "kubeflow_pipelines.object_store.auth.secret_name" . | quote >}}
                  key: {{< tmpl.Exec "kubeflow_pipelines.object_store.auth.access_key_key" . | quote >}}
              {{<- end >}}
            - name: MINIO_SECRET_KEY
              {{<- if .Values.kubeflow_tools.pipelines.objectStore.auth.fromEnv >}}
              value: ""
              valueFrom:
                $patch: delete
              {{<- else >}}
              valueFrom:
                secretKeyRef:
                  name: {{< tmpl.Exec "kubeflow_pipelines.object_store.auth.secret_name" . | quote >}}
                  key: {{< tmpl.Exec "kubeflow_pipelines.object_store.auth.secret_key_key" . | quote >}}
              {{<- end >}}

            ## ================================
            ## S3 - Object Store Configs
            ## ================================
            ## NOTE: we set both the S3 & Minio configs because we don't know what kind of object store the user is using
            - name: AWS_REGION
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: bucketRegion
            - name: AWS_S3_ENDPOINT
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  ## NOTE: we use hostname only, KFP doesn't allow ports in the s3 endpoint config
                  key: bucketHost
            - name: AWS_SSL
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: bucketSecure
            - name: AWS_ACCESS_KEY_ID
              {{<- if .Values.kubeflow_tools.pipelines.objectStore.auth.fromEnv >}}
              value: ""
              valueFrom:
                $patch: delete
              {{<- else >}}
              valueFrom:
                secretKeyRef:
                  name: {{< tmpl.Exec "kubeflow_pipelines.object_store.auth.secret_name" . | quote >}}
                  key: {{< tmpl.Exec "kubeflow_pipelines.object_store.auth.access_key_key" . | quote >}}
              {{<- end >}}
            - name: AWS_SECRET_ACCESS_KEY
              {{<- if .Values.kubeflow_tools.pipelines.objectStore.auth.fromEnv >}}
              value: ""
              valueFrom:
                $patch: delete
              {{<- else >}}
              valueFrom:
                secretKeyRef:
                  name: {{< tmpl.Exec "kubeflow_pipelines.object_store.auth.secret_name" . | quote >}}
                  key: {{< tmpl.Exec "kubeflow_pipelines.object_store.auth.secret_key_key" . | quote >}}
              {{<- end >}}

            ## ================================
            ## Other Configs
            ## ================================
            ## we must explicitly disable calls to the GKE metadata API, as many users are not on GKE
            ## https://github.com/kubeflow/pipelines/issues/3070
            - name: DISABLE_GKE_METADATA
              value: "true"