apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
spec:
  replicas: {{ include "urlaubsverwaltung.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.urlaubsverwaltung.replicas) }}
  selector:
    matchLabels:
      app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
  template:
    metadata:
      name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
      labels:
        app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
    spec:
      automountServiceAccountToken: false
      securityContext:
        {{- include "urlaubsverwaltung.podSecurityContext" .Values.urlaubsverwaltung.securityContext | nindent 8 }}
      containers:
        - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
          image: "docker.io/urlaubsverwaltung/urlaubsverwaltung:{{ .Chart.AppVersion }}"
          imagePullPolicy: IfNotPresent
          securityContext:
            {{- include "urlaubsverwaltung.containerSecurityContext" .Values.urlaubsverwaltung.securityContext | nindent 12 }}
          volumeMounts:
            # The JVM (Tomcat work dir, temp files) needs a writable /tmp with
            # a read-only root filesystem.
            - name: tmp
              mountPath: /tmp
          ports:
            - containerPort: 8080
              name: http
              protocol: TCP
          env:
            # Database
            - name: SPRING_DATASOURCE_URL
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
                  key: jdbc-url
            - name: SPRING_DATASOURCE_USERNAME
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
                  key: username
            - name: SPRING_DATASOURCE_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
                  key: password
            # Health indicators and probe groups
            #
            # Spring Boot creates the "liveness" and "readiness" groups by
            # itself here (measured: /actuator/health answers
            # {"groups":["liveness","readiness"]} with nothing configured), but
            # the readiness group ships with readinessState ALONE. Without the
            # line below a total database outage leaves /actuator/health/readiness
            # at 200 and the pod 1/1 Ready while every request fails (#218).
            # Naming the group's members REPLACES the default, so readinessState
            # has to be repeated. "db" is the datasource indicator's real name,
            # read off the running endpoint.
            - name: MANAGEMENT_ENDPOINT_HEALTH_GROUP_READINESS_INCLUDE
              value: "readinessState,db"
            # The liveness group is deliberately NOT extended: a database
            # outage has to keep traffic away, but restarting the pod does not
            # bring the database back — it would only add a crash loop to the
            # outage.
            #
            # The mail indicator is switched off because the mail wiring below
            # points at localhost:1025, where nothing listens. Left on, it holds
            # the aggregate /actuator/health at 503 DOWN for the whole life of a
            # healthy release (#217). Anyone who later configures real mail
            # delivery has to switch it back on via urlaubsverwaltung.env, or
            # the endpoint stays blind to a broken mail server.
            - name: MANAGEMENT_HEALTH_MAIL_ENABLED
              value: "false"
            # Mail
            - name: UV_MAIL_FROM
              value: urlaubsverwaltung@example.org
            - name: UV_MAIL_FROMDISPLAYNAME
              value: urlaubsverwaltung
            - name: UV_MAIL_REPLYTO
              value: urlaubsverwaltung@example.org
            - name: UV_MAIL_REPLYTODISPLAYNAME
              value: urlaubsverwaltung
            - name: UV_MAIL_APPLICATIONURL
              value: http://localhost:8080
            - name: SPRING_MAIL_HOST
              value: localhost
            - name: SPRING_MAIL_PORT
              value: "1025"
            # Calendar
            - name: UV_CALENDAR_ORGANIZER
              value: organizer@example.org
            # OpenID Connect identity provider
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_CLIENT-ID
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
                  key: client-id
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_CLIENT-SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
                  key: client-secret
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_CLIENT-NAME
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
                  key: issuer-name
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_PROVIDER
              value: default
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_SCOPE
              value: openid,profile,email,roles,offline_access,uv_claims
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_AUTHORIZATION-GRANT-TYPE
              value: authorization_code
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_REDIRECT-URI
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
                  key: redirect-uri
            - name: SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_DEFAULT_ISSUER-URI
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
                  key: issuer-uri
            - name: SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER-URI
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
                  key: jwt-issuer-uri
            - name: UV_SECURITY_OIDC_CLAIM-MAPPERS_GROUP-CLAIM_ENABLED
              value: "true"
            - name: UV_SECURITY_OIDC_CLAIM-MAPPERS_GROUP-CLAIM_CLAIM-NAME
              value: "groups"
            {{- range $value := .Values.urlaubsverwaltung.env }}
            {{- if $value.value }}
            - name: {{ $value.name | quote }}
              value: {{ tpl $value.value $ | quote }}
            {{- else if $value.valueFrom }}
            {{- if $value.valueFrom.secretKeyRef }}
            - name: {{ $value.name }}
              valueFrom:
                secretKeyRef:
                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
            {{- else if $value.valueFrom.configMapKeyRef }}
            - name: {{ $value.name }}
              valueFrom:
                configMapKeyRef:
                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
            {{- end }}
            {{- end }}
            {{- end }}
          resources:
            {{- include "urlaubsverwaltung.effectiveResources" .Values.urlaubsverwaltung.resources | nindent 12 }}
          livenessProbe:
            {{- include "urlaubsverwaltung.livenessProbe" .Values.urlaubsverwaltung.livenessProbe | nindent 12 }}
          readinessProbe:
            {{- include "urlaubsverwaltung.readinessProbe" .Values.urlaubsverwaltung.readinessProbe | nindent 12 }}
          startupProbe:
            {{- include "urlaubsverwaltung.startupProbe" .Values.urlaubsverwaltung.startupProbe | nindent 12 }}
      volumes:
        - name: tmp
          emptyDir: {}
      restartPolicy: Always