apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-deployment
  labels:
    app: {{ .Chart.Name }}-{{ .Release.Name }}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: {{ .Chart.Name }}-{{ .Release.Name }}-uv-deployment
  template:
    metadata:
      name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-deployment
      labels:
        app: {{ .Chart.Name }}-{{ .Release.Name }}-uv-deployment
    spec:
      automountServiceAccountToken: false
      securityContext:
        {{- toYaml .Values.urlaubsverwaltung.securityContext.pod | nindent 8 }}
      containers:
        - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-container
          image: "urlaubsverwaltung/urlaubsverwaltung:{{ .Chart.AppVersion }}"
          imagePullPolicy: IfNotPresent
          securityContext:
            {{- toYaml .Values.urlaubsverwaltung.securityContext.container | nindent 12 }}
          volumeMounts:
            # The JVM (Tomcat work dir, temp files) needs a writable /tmp with
            # a read-only root filesystem.
            - name: tmp
              mountPath: /tmp
          ports:
            - containerPort: 8080
              name: http
              protocol: TCP
          env:
            # Database
            - name: SPRING_DATASOURCE_URL
              valueFrom:
                secretKeyRef:
                  name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-db-secret
                  key: jdbc-url
            - name: SPRING_DATASOURCE_USERNAME
              valueFrom:
                secretKeyRef:
                  name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-db-secret
                  key: username
            - name: SPRING_DATASOURCE_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-db-secret
                  key: password
            # Mail
            - name: UV_MAIL_FROM
              value: urlaubsverwaltung@example.org
            - name: UV_MAIL_FROMDISPLAYNAME
              value: urlaubsverwaltung
            - name: UV_MAIL_REPLYTO
              value: urlaubsverwaltung@example.org
            - name: UV_MAIL_REPLYTODISPLAYNAME
              value: urlaubsverwaltung
            - name: UV_MAIL_APPLICATIONURL
              value: http://localhost:8080
            - name: SPRING_MAIL_HOST
              value: localhost
            - name: SPRING_MAIL_PORT
              value: "1025"
            # Calendar
            - name: UV_CALENDAR_ORGANIZER
              value: organizer@example.org
            # OpenID Connect identity provider
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_CLIENT-ID
              valueFrom:
                secretKeyRef:
                  name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret
                  key: client-id
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_CLIENT-SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret
                  key: client-secret
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_CLIENT-NAME
              valueFrom:
                secretKeyRef:
                  name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret
                  key: issuer-name
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_PROVIDER
              value: default
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_SCOPE
              value: openid,profile,email,roles,offline_access,uv_claims
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_AUTHORIZATION-GRANT-TYPE
              value: authorization_code
            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_REDIRECT-URI
              valueFrom:
                secretKeyRef:
                  name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret
                  key: redirect-uri
            - name: SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_DEFAULT_ISSUER-URI
              valueFrom:
                secretKeyRef:
                  name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret
                  key: issuer-uri
            - name: SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER-URI
              valueFrom:
                secretKeyRef:
                  name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret
                  key: jwt-issuer-uri
            - name: UV_SECURITY_OIDC_CLAIM-MAPPERS_GROUP-CLAIM_ENABLED
              value: "true"
            - name: UV_SECURITY_OIDC_CLAIM-MAPPERS_GROUP-CLAIM_CLAIM-NAME
              value: "groups"
          resources:
            {{- include "urlaubsverwaltung.resources" .Values.urlaubsverwaltung.resources | nindent 12 }}
          readinessProbe:
            httpGet:
              port: 8080
              path: /actuator/health/readiness
            periodSeconds: 5
            failureThreshold: 3
            successThreshold: 1
            timeoutSeconds: 5
          livenessProbe:
            httpGet:
              port: 8080
              path: /actuator/health/liveness
            periodSeconds: 10
            failureThreshold: 3
            successThreshold: 1
            timeoutSeconds: 5
          # The startup probe gates liveness/readiness. Spring Boot startup
          # (JVM + Liquibase migrations) gets a budget of 10s * 30 = 300s.
          startupProbe:
            httpGet:
              port: 8080
              path: /actuator/health/liveness
            periodSeconds: 10
            failureThreshold: 30
            timeoutSeconds: 5
      volumes:
        - name: tmp
          emptyDir: {}
      restartPolicy: Always