apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "trust-manager.name" . }}
  namespace: {{ include "trust-manager.namespace" . }}
  #################### BEGIN CHANGE ####################
  annotations:
    {{- toYaml .Values.app.deploymentAnnotations | nindent 4 }}
  ##################### END CHANGE #####################
  labels:
    {{- include "trust-manager.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      app: {{ include "trust-manager.name" . }}
  template:
    metadata:
      {{- with .Values.app.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        app: {{ include "trust-manager.name" . }}
        {{- include "trust-manager.labels" . | nindent 8 }}
        {{- with .Values.app.podLabels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      serviceAccountName: {{ include "trust-manager.name" . }}
      {{- if .Values.defaultPackage.enabled }}
      initContainers:
      - name: cert-manager-package-debian
        image: "{{ template "image" (tuple .Values.defaultPackageImage "missing") }}"
        imagePullPolicy: {{ .Values.defaultPackageImage.pullPolicy }}
        args:
          - "/copyandmaybepause"
          - "/debian-package"
          - "/packages"
        volumeMounts:
        - mountPath: /packages
          name: packages
          readOnly: false
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          {{- if .Values.app.securityContext.seccompProfileEnabled }}
          seccompProfile:
            type: RuntimeDefault
          {{- end }}
        {{- if .Values.defaultPackage.resources }}
        resources:
          {{- toYaml .Values.defaultPackage.resources | nindent 10 }}
        {{- end }}
      {{- end }}
      containers:
      - name: {{ include "trust-manager.name" . }}
        image: "{{ template "image" (tuple .Values.image $.Chart.AppVersion) }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        ports:
        - containerPort: {{ .Values.app.webhook.port }}
        - containerPort: {{ .Values.app.metrics.port }}
        readinessProbe:
          httpGet:
            port: {{ .Values.app.readinessProbe.port }}
            path: {{ .Values.app.readinessProbe.path }}
          initialDelaySeconds: 3
          periodSeconds: 7
        command: ["trust-manager"]
        args:
          - "--log-level={{.Values.app.logLevel}}"
          - "--metrics-port={{.Values.app.metrics.port}}"
          - "--readiness-probe-port={{.Values.app.readinessProbe.port}}"
          - "--readiness-probe-path={{.Values.app.readinessProbe.path}}"
            # trust
          - "--trust-namespace={{.Values.app.trust.namespace}}"
            # webhook
          - "--webhook-host={{.Values.app.webhook.host}}"
          - "--webhook-port={{.Values.app.webhook.port}}"
          - "--webhook-certificate-dir=/tls"
          {{- if .Values.defaultPackage.enabled }}
          - "--default-package-location=/packages/cert-manager-package-debian.json"
          {{- end }}
          {{- if .Values.secretTargets.enabled }}
          - "--secret-targets-enabled=true"
          {{- end }}
          {{- if .Values.filterExpiredCertificates.enabled }}
          - "--filter-expired-certificates=true"
          {{- end }}
        volumeMounts:
        - mountPath: /tls
          name: tls
          readOnly: true
        - mountPath: /packages
          name: packages
          readOnly: true
        resources:
          {{- toYaml .Values.resources | nindent 12 }}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          {{- if .Values.app.securityContext.seccompProfileEnabled }}
          seccompProfile:
            type: RuntimeDefault
          {{- end }}
      {{- with .Values.priorityClassName }}
      priorityClassName: "{{ . }}"
      {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with  .Values.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
      - name: packages
        emptyDir:
          sizeLimit: 50M
      - name: tls
        secret:
          defaultMode: 420
          secretName: {{ include "trust-manager.name" . }}-tls
      {{- if .Values.app.webhook.hostNetwork }}
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      {{- end }}

