{{- if .Values.createController }}
apiVersion: {{ include "sealed-secrets.deployment.apiVersion" . }}
kind: Deployment
metadata:
  name: {{ include "sealed-secrets.fullname" . }}
  namespace: {{ include "sealed-secrets.namespace" . }}
  labels: {{- include "sealed-secrets.labels" . | nindent 4 }}
    {{- if .Values.commonLabels }}
    {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }}
    {{- end }}
  annotations:
    {{- if .Values.commonAnnotations }}
    {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
    {{- end }}
spec:
  replicas: 1
  {{- if .Values.revisionHistoryLimit }}
  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
  {{- end }}
  selector:
    matchLabels: {{- include "sealed-secrets.matchLabels" . | nindent 6 }}
  template:
    metadata:
      {{- if .Values.podAnnotations }}
      annotations: {{- toYaml .Values.podAnnotations | nindent 8 }}
      {{- end }}
      labels: {{- include "sealed-secrets.matchLabels" . | nindent 8 }}
        {{- if .Values.podLabels }}
        {{- toYaml .Values.podLabels | nindent 8 }}
        {{- end }}
    spec:
      {{- if .Values.image.pullSecrets }}
      imagePullSecrets:
      {{- range .Values.image.pullSecrets }}
        - name: {{ . }}
      {{- end }}
      {{- end }}
      {{- if .Values.affinity }}
      affinity: {{- toYaml .Values.affinity | nindent 8 }}
      {{- end }}
      {{- if .Values.nodeSelector }}
      nodeSelector: {{- toYaml .Values.nodeSelector | nindent 8 }}
      {{- end }}
      {{- if .Values.tolerations }}
      tolerations: {{- toYaml .Values.tolerations | nindent 8 }}
      {{- end }}
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName | quote }}
      {{- end }}
      {{- if .Values.runtimeClassName }}
      runtimeClassName: {{ .Values.runtimeClassName | quote }}
      {{- end }}
      {{- if .Values.podSecurityContext.enabled }}
      securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "sealed-secrets.serviceAccountName" . }}
      {{- if kindIs "bool" .Values.hostUsers }}
      hostUsers: {{ .Values.hostUsers }}
      {{- end }}
      {{- if .Values.hostNetwork }}
      hostNetwork: true
      {{- end }}
      {{- if .Values.dnsPolicy }}
      dnsPolicy: {{ .Values.dnsPolicy }}
      {{- end }}
      containers:
        - name: controller
          command:
          {{- if .Values.command }}
            {{- include "sealed-secrets.render" (dict "value" .Values.command "context" $) | nindent 12 }}
          {{- else }}
            - controller
          {{- end }}
          args:
          {{- if .Values.args }}
            {{- include "sealed-secrets.render" (dict "value" .Values.args "context" $) | nindent 12 }}
          {{- else }}
            {{- if .Values.updateStatus }}
            - --update-status
            {{- end }}
            {{- if .Values.skipRecreate }}
            - --skip-recreate
            {{- end }}
            {{- if ne (.Values.keyrenewperiod | toString) "" }}
            - --key-renew-period
            - {{ .Values.keyrenewperiod | quote }}
            {{- end }}
            {{- if .Values.keyttl }}
            - --key-ttl
            - {{ .Values.keyttl | quote }}
            {{- end }}
            {{- if .Values.keycutofftime }}
            - --key-cutoff-time
            - {{ .Values.keycutofftime | quote }}
            {{- end }}
            {{- if .Values.rateLimit }}
            - --rate-limit
            - {{ .Values.rateLimit | quote }}
            {{- end }}
            {{- if .Values.rateLimitBurst }}
            - --rate-limit-burst
            - {{ .Values.rateLimitBurst | quote }}
            {{- end }}
            - --key-prefix
            - {{ .Values.secretName | quote }}
            {{- if .Values.additionalNamespaces }}
            - --additional-namespaces
            - {{ join "," .Values.additionalNamespaces | quote }}
            {{- end }}
            {{- if $.Values.privateKeyAnnotations }}
            {{- $privatekeyAnnotations := ""}}
            {{- range $k, $v := $.Values.privateKeyAnnotations }}
              {{- if not (and $v (kindIs "string" $v)) }}
                {{ fail "Annotation values have to be strings"}}
              {{- end }}
              {{- $privatekeyAnnotations = printf "%s=%s,%s" $k $v $privatekeyAnnotations}}
            {{- end }}
            - --privatekey-annotations
            - {{ trimSuffix "," $privatekeyAnnotations | quote }}
            {{- end }}
            {{- if $.Values.privateKeyLabels }}
            {{- $privateKeyLabels := ""}}
            {{- range $k, $v := $.Values.privateKeyLabels }}
              {{- if not (and $v (kindIs "string" $v)) }}
                {{ fail "Label values have to be strings"}}
              {{- end }}
              {{- $privateKeyLabels = printf "%s=%s,%s" $k $v $privateKeyLabels}}
            {{- end }}
            - --privatekey-labels
            - {{ trimSuffix "," $privateKeyLabels | quote }}
            {{- end }}
            {{- if .Values.logInfoStdout }}
            - --log-info-stdout
            {{- end }}
            {{- if .Values.logLevel }}
            - --log-level
            - {{ .Values.logLevel }}
            {{- end }}
            {{- if .Values.logFormat }}
            - --log-format
            - {{ .Values.logFormat }}
            {{- end }}
            {{- if .Values.containerPorts.http }}
            - --listen-addr
            - {{ printf ":%s" (.Values.containerPorts.http | toString ) }}
            {{- end }}
            {{- if .Values.containerPorts.metrics }}
            - --listen-metrics-addr
            - {{ printf ":%s" (.Values.containerPorts.metrics | toString) }}
            {{- end }}
            {{- if .Values.maxRetries }}
            - --max-unseal-retries
            - {{ .Values.maxRetries | quote }}
            {{- end }}
            {{- if .Values.watchForSecrets }}
            - --watch-for-secrets
            {{- end }}
            {{- if .Values.kubeClientQPS }}
            - --kubeclient-qps
            - {{ .Values.kubeClientQPS | quote }}
            {{- end }}
            {{- if .Values.kubeClientBurst }}
            - --kubeclient-burst
            - {{ .Values.kubeClientBurst | quote }}
            {{- end }}
          {{- end }}
          image: {{ printf "%s/%s:%s" .Values.image.registry .Values.image.repository .Values.image.tag }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          env:
            {{- if (.Values.resources.limits).cpu }}
            - name: GOMAXPROCS
              valueFrom:
                resourceFieldRef:
                  resource: limits.cpu
                  divisor: "1"
            {{- end }}
            {{- if (.Values.resources.limits).memory }}
            - name: GOMEMLIMIT
              valueFrom:
                resourceFieldRef:
                  resource: limits.memory
                  divisor: "1"
            {{- end }}
          ports:
            - name: http
              containerPort: {{ .Values.containerPorts.http | default "8080" }}
              protocol: TCP
              {{- if .Values.hostNetwork }}
              hostPort: {{ .Values.containerPorts.http }}
              {{- else if .Values.hostPorts.http }}
              hostPort: {{ .Values.hostPorts.http }}
              {{- end }}
            - name: metrics
              containerPort: {{ .Values.containerPorts.metrics | default "8081" }}
              protocol: TCP
              {{- if .Values.hostNetwork }}
              hostPort: {{ .Values.containerPorts.metrics }}
              {{- else if .Values.hostPorts.metrics }}
              hostPort: {{ .Values.hostPorts.metrics }}
              {{- end }}
          {{- if .Values.startupProbe.enabled }}
          startupProbe: {{- include "sealed-secrets.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }}
            tcpSocket:
              port: http
          {{- else if .Values.customStartupProbe }}
          startupProbe: {{- include "sealed-secrets.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
          {{- end }}
          {{- if .Values.livenessProbe.enabled }}
          livenessProbe: {{- include "sealed-secrets.render" (dict "value" (omit .Values.livenessProbe "enabled") "context" $) | nindent 12 }}
            httpGet:
              path: /healthz
              port: http
          {{- else if .Values.customLivenessProbe }}
          livenessProbe: {{- include "sealed-secrets.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
          {{- end }}
          {{- if .Values.readinessProbe.enabled }}
          readinessProbe: {{- include "sealed-secrets.render" (dict "value" (omit .Values.readinessProbe "enabled") "context" $) | nindent 12 }}
            httpGet:
              path: /healthz
              port: http
          {{- else if .Values.customReadinessProbe }}
          readinessProbe: {{- include "sealed-secrets.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
          {{- end }}
          {{- if .Values.resources }}
          resources: {{- toYaml .Values.resources | nindent 12 }}
          {{- end }}
          {{- if .Values.containerSecurityContext.enabled }}
          securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
          volumeMounts:
            {{- if .Values.additionalVolumeMounts }}
              {{- toYaml .Values.additionalVolumeMounts | nindent 12 }}
            {{- end }}
            - mountPath: /tmp
              name: tmp
      volumes:
      {{- if .Values.additionalVolumes }}
        {{- toYaml .Values.additionalVolumes | nindent 8 }}
      {{- end }}
        - name: tmp
          emptyDir: {}
{{- end }}
