apiVersion: apps/v1
kind: Deployment
metadata:
  name: ml-pipeline
spec:
  template:
    spec:
      securityContext:
        ## NOTE: this is important for AWS IRSA
        fsGroup: 65534
      containers:
        - name: ml-pipeline-api-server
          readinessProbe:
            ## NOTE: we remove the readinessProbe because this Deployment has only 1 replica,
            ##       so there is never a case when we don't want to at least try and send traffic to the Pod,
            ##       also, the livenessProbe will restart the Pod if it becomes unhealthy,
            ##       and the startupProbe protects the Pod during startup
            $patch: delete
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
          startupProbe:
            failureThreshold: 10
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          env:
            ## ================================
            ## UserID Configs
            ## ================================
            - name: KUBEFLOW_USERID_HEADER
              value: null
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: USERID_HEADER
            - name: KUBEFLOW_USERID_PREFIX
              value: null
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: USERID_PREFIX

            ## ================================
            ## Workflow Image Configs
            ## ================================
            - name: V2_DRIVER_IMAGE
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: driverImage
            - name: V2_LAUNCHER_IMAGE
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: launcherImage

            ## ================================
            ## MySQL Secrets
            ## ================================
            - name: DBCONFIG_MYSQLCONFIG_USER
              valueFrom:
                secretKeyRef:
                  name: {{< tmpl.Exec "kubeflow_pipelines.mysql.auth.secret_name" . | quote >}}
                  key: {{< tmpl.Exec "kubeflow_pipelines.mysql.auth.secret_username_key" . | quote >}}
            - name: DBCONFIG_MYSQLCONFIG_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{< tmpl.Exec "kubeflow_pipelines.mysql.auth.secret_name" . | quote >}}
                  key: {{< tmpl.Exec "kubeflow_pipelines.mysql.auth.secret_password_key" . | quote >}}

            ## ================================
            ## MySQL Secrets (Legacy)
            ## ================================
            - name: DBCONFIG_USER
              valueFrom:
                secretKeyRef:
                  name: {{< tmpl.Exec "kubeflow_pipelines.mysql.auth.secret_name" . | quote >}}
                  key: {{< tmpl.Exec "kubeflow_pipelines.mysql.auth.secret_username_key" . | quote >}}
            - name: DBCONFIG_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{< tmpl.Exec "kubeflow_pipelines.mysql.auth.secret_name" . | quote >}}
                  key: {{< tmpl.Exec "kubeflow_pipelines.mysql.auth.secret_password_key" . | quote >}}

            ## ================================
            ## Bucket Configs
            ## ================================
            - name: OBJECTSTORECONFIG_BUCKETNAME
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: bucketName
            - name: OBJECTSTORECONFIG_REGION
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: bucketRegion

            ## ================================
            ## Object Store Configs
            ## ================================
            - name: OBJECTSTORECONFIG_SECURE
              value: null
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: bucketSecure
            - name: OBJECTSTORECONFIG_HOST
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: bucketHost
            - name: OBJECTSTORECONFIG_PORT
              valueFrom:
                configMapKeyRef:
                  name: pipeline-install-config
                  key: bucketPort
            - name: OBJECTSTORECONFIG_ACCESSKEY
              {{<- if .Values.kubeflow_tools.pipelines.objectStore.auth.fromEnv >}}
              value: ""
              valueFrom:
                $patch: delete
              {{<- else >}}
              valueFrom:
                secretKeyRef:
                  name: {{< tmpl.Exec "kubeflow_pipelines.object_store.auth.secret_name" . | quote >}}
                  key: {{< tmpl.Exec "kubeflow_pipelines.object_store.auth.access_key_key" . | quote >}}
              {{<- end >}}
            - name: OBJECTSTORECONFIG_SECRETACCESSKEY
              {{<- if .Values.kubeflow_tools.pipelines.objectStore.auth.fromEnv >}}
              value: ""
              valueFrom:
                $patch: delete
              {{<- else >}}
              valueFrom:
                secretKeyRef:
                  name: {{< tmpl.Exec "kubeflow_pipelines.object_store.auth.secret_name" . | quote >}}
                  key: {{< tmpl.Exec "kubeflow_pipelines.object_store.auth.secret_key_key" . | quote >}}
              {{<- end >}}