{{- $settings := fromYaml (include "bulwark.settings" .) -}}
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-service
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
spec:
  selector:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
  ports:
    # The one port this application serves. targetPort addresses the container
    # port BY NAME, so bulwark.port can be changed freely while renaming the port
    # would break this and all three probes at once.
    - protocol: TCP
      port: {{ $settings.port | int64 }}
      targetPort: http
      name: http
  # ClusterIP, and no value to change it. The way out of the cluster is the
  # Ingress with a certificate: this is a webmail client that handles session
  # cookies and mail content, so a NodePort would put it on a routable address
  # over plain HTTP by accident.
  type: ClusterIP
---
{{/*
The headless Service a StatefulSet needs for its serviceName. It exists because
a StatefulSet requires one, not because anything addresses the pod by its stable
DNS name - with one replica and no peer coordination there is nothing to address.
Kept separate from the ClusterIP Service above so that the latter stays a plain
load-balanced endpoint for the Ingress; pointing serviceName at a Service with a
ClusterIP is accepted by the API server but gives the pod no per-pod DNS record,
which is the kind of half-working arrangement that only shows up later.
*/}}
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-headless
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
spec:
  clusterIP: None
  selector:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
  ports:
    - protocol: TCP
      port: {{ $settings.port | int64 }}
      targetPort: http
      name: http