apiVersion: apps/v1
kind: Deployment
metadata:
  name: dex
  labels:
    helm.sh/chart: {{ include "deploykf-auth.labels.chart" . }}
    app.kubernetes.io/name: {{ include "deploykf-auth.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/component: dex
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ include "deploykf-auth.labels.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/managed-by: {{ .Release.Service }}
      app.kubernetes.io/component: dex
  template:
    metadata:
      annotations:
        checksum/secret-dex: {{ include (print $.Template.BasePath "/dex/Secret-config.yaml") . | sha256sum }}
        checksum/secret-oauth2-proxy: {{ include (print $.Template.BasePath "/oauth2-proxy/Secret-config.yaml") . | sha256sum }}
      labels:
        app.kubernetes.io/name: {{ include "deploykf-auth.labels.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name }}
        app.kubernetes.io/managed-by: {{ .Release.Service }}
        app.kubernetes.io/component: dex
    spec:
      {{- if .Values.dex.image.pullSecret }}
      imagePullSecrets:
        - name: {{ .Values.dex.image.pullSecret }}
      {{- end }}
      nodeSelector: {}
      affinity: {}
      tolerations: []
      serviceAccountName: dex
      securityContext: {}
      containers:
        - name: dex
          image: {{ .Values.dex.image.repository }}:{{ .Values.dex.image.tag }}
          imagePullPolicy: {{ .Values.dex.image.pullPolicy }}
          securityContext:
            runAsUser: {{ .Values.dex.image.uid }}
            runAsGroup: {{ .Values.dex.image.gid }}
          {{- if .Values.dex.resources }}
          resources:
            {{- toYaml .Values.dex.resources | nindent 12 }}
          {{- end }}
          env:
            ## the official dex image supports using gomplate to template its config file
            ## we set unique gomplate delimiters (so we don't have to escape them inside our helm templates)
            - name: GOMPLATE_LEFT_DELIM
              value: "<<"
            - name: GOMPLATE_RIGHT_DELIM
              value: ">>"

            ## connector configs don't provide a way to escape `$`, and can already read env vars with gomplate
            ## https://github.com/dexidp/dex/pull/1902
            - name: DEX_EXPAND_ENV
              value: "false"

            {{- range $user:= .Values.dex.staticPasswords }}
            {{- if and $user.password.existingSecret $user.password.existingSecretKey }}
            {{- $password_env := include "deploykf-auth.dex.password_env" (dict "name" $user.password.existingSecret "key" $user.password.existingSecretKey) }}
            - name: {{ $password_env | quote }}
              valueFrom:
                secretKeyRef:
                  name: {{ $user.password.existingSecret | quote }}
                  key: {{ $user.password.existingSecretKey | quote }}
            {{- end }}
            {{- end }}

            {{- range $connector := .Values.dex.connectors }}
            {{- if and $connector.configExistingSecret $connector.configExistingSecretKey }}
            {{- $connector_env := include "deploykf-auth.dex.connector_env" (dict "name" $connector.configExistingSecret "key" $connector.configExistingSecretKey) }}
            - name: {{ $connector_env | quote }}
              valueFrom:
                secretKeyRef:
                  name: {{ $connector.configExistingSecret | quote }}
                  key: {{ $connector.configExistingSecretKey | quote }}
            {{- end }}
            {{- end }}

            {{- if .Values.dex.clients.oauth2Proxy.clientSecret.existingSecret }}
            - name: CONFIG__CLIENT_SECRET__OAUTH2_PROXY
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.dex.clients.oauth2Proxy.clientSecret.existingSecret | quote }}
                  key: {{ .Values.dex.clients.oauth2Proxy.clientSecret.existingSecretKey | quote }}
            {{- end }}
            {{- if and .Values.dex.clients.minioConsole.enabled .Values.dex.clients.minioConsole.clientSecret.existingSecret }}
            - name: CONFIG__CLIENT_SECRET__MINIO_CONSOLE
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.dex.clients.minioConsole.clientSecret.existingSecret | quote }}
                  key: {{ .Values.dex.clients.minioConsole.clientSecret.existingSecretKey | quote }}
            {{- end }}
            {{- if and .Values.dex.clients.argoServer.enabled .Values.dex.clients.argoServer.clientSecret.existingSecret }}
            - name: CONFIG__CLIENT_SECRET__ARGO_SERVER
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.dex.clients.argoServer.clientSecret.existingSecret | quote }}
                  key: {{ .Values.dex.clients.argoServer.clientSecret.existingSecretKey | quote }}
            {{- end }}
          args:
            - "dex"
            - "serve"
            - "/etc/dex/config.yaml"
          ports:
            - name: http
              containerPort: 5556
              protocol: TCP
            - name: telemetry
              containerPort: 5558
              protocol: TCP
          livenessProbe:
            initialDelaySeconds: 15
            periodSeconds: 30
            httpGet:
              path: /healthz/live
              port: telemetry
          readinessProbe:
            httpGet:
              path: /healthz/ready
              port: telemetry
          volumeMounts:
            - name: dex-config
              mountPath: /etc/dex/config.yaml
              subPath: config.yaml
              readOnly: true
            - name: dex-theme
              mountPath: /srv/dex/web/themes/light/logo.svg
              subPath: logo.svg
              readOnly: true
            - name: dex-theme
              mountPath: /srv/dex/web/themes/light/favicon.png
              subPath: favicon.svg
              readOnly: true
      volumes:
        - name: dex-config
          secret:
            secretName: dex-config
        - name: dex-theme
          configMap:
            name: dex-theme