# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{ define "drone.name" }}{{ default "drone" .Values.nameOverride | trunc 63 }}{{ end }}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this
(by the DNS naming spec).
*/}}
{{ define "drone.fullname" }}
{{- $name := default "drone" .Values.nameOverride -}}
{{ printf "%s-%s" .Release.Name $name | trunc 63 -}}
{{ end }}

{{/*
Allow overwrite of rpc server.
*/}}
{{ define "drone.rpcServer" }}
{{- if .Values.agent.rpcServerOverride -}}
  {{ .Values.agent.rpcServerOverride }}
{{- else -}}
  {{ printf "http://%s" (include "drone.fullname" .) }}
{{- end -}}
{{- end -}}

{{/*
Create the name of the service account to use
*/}}
{{- define "drone.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
    {{ default (include "drone.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
    {{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}

{{/*
Create the name of the secret for source control
*/}}
{{- define "drone.sourceControlSecret" -}}
{{- if .Values.sourceControl.secret -}}
    {{ printf "%s" .Values.sourceControl.secret }}
{{- else -}}
    {{ printf "%s-%s" (include "drone.fullname" .) "source-control" | trunc 63 -}}
{{- end -}}
{{- end -}}

{{/*
Create the name of the service account to use for kubernetes pipelines
*/}}
{{- define "drone.pipelineServiceAccount" -}}
{{- if .Values.serviceAccount.create -}}
  {{- $psa := printf "%s-%s" (include "drone.serviceAccountName" .) "pipeline" | trunc 63 -}}
  {{ default $psa .Values.server.kubernetes.pipelineServiceAccount }}
{{- else -}}
  {{ default "default" .Values.server.kubernetes.pipelineServiceAccount }}
{{- end -}}
{{- end -}}

{{/*
Create the name of the secret for an enterprise license key
*/}}
{{- define "drone.licenseKeySecret" -}}
{{- if .Values.licenseKeySecret -}}
  {{ printf "%s" .Values.licenseKeySecret }}
{{- else -}}
  {{ printf "%s-%s" (include "drone.fullname" .) "license-key" | trunc 63 }}
{{- end -}}
{{- end -}}

{{/*
Return the appropriate apiVersion for ingress.
*/}}
{{- define "drone.ingress.apiVersion" -}}
{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}}
{{- print "extensions/v1beta1" -}}
{{- else if semverCompare "^1.14-0" .Capabilities.KubeVersion.GitVersion -}}
{{- print "networking.k8s.io/v1beta1" -}}
{{- end -}}
{{- end -}}
 # _provider-envs.yaml
{{- define "drone.providerEnvs" -}}
{{- if eq .Values.sourceControl.provider "github" -}}
          - name: DRONE_GITHUB_CLIENT_ID
            value: {{ .Values.sourceControl.github.clientID }}
          - name: DRONE_GITHUB_SERVER
            value: {{ .Values.sourceControl.github.server }}
          - name: DRONE_GITHUB_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: {{ template "drone.sourceControlSecret" . }}
                key: {{ .Values.sourceControl.github.clientSecretKey }}
{{- end -}}
{{- if eq .Values.sourceControl.provider "gitlab" -}}
          - name: DRONE_GITLAB_CLIENT_ID
            value: {{ .Values.sourceControl.gitlab.clientID }}
          - name: DRONE_GITLAB_SERVER
            value: {{ .Values.sourceControl.gitlab.server }}
          - name: DRONE_GITLAB_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: {{ template "drone.sourceControlSecret" . }}
                key: {{ .Values.sourceControl.gitlab.clientSecretKey }}
{{- end -}}
{{- if eq .Values.sourceControl.provider "gitea" -}}
          - name: DRONE_GITEA_CLIENT_ID
            value: {{ .Values.sourceControl.gitea.clientID }}
          - name: DRONE_GITEA_SERVER
            value: {{ .Values.sourceControl.gitea.server }}
          - name: DRONE_GITEA_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: {{ template "drone.sourceControlSecret" . }}
                key: {{ .Values.sourceControl.gitea.clientSecretKey }}
{{- end -}}
{{- if eq .Values.sourceControl.provider "gogs" -}}
          - name: DRONE_GOGS_SERVER
            value: {{ .Values.sourceControl.gogs.server }}
{{- end -}}
{{- if eq .Values.sourceControl.provider "bitbucketCloud" -}}
          - name: DRONE_BITBUCKET_CLIENT_ID
            value: {{ .Values.sourceControl.bitbucketCloud.clientID }}
          - name: DRONE_BITBUCKET_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: {{ template "drone.sourceControlSecret" . }}
                key: {{ .Values.sourceControl.bitbucketCloud.clientSecretKey }}
{{- end -}}
{{- if eq .Values.sourceControl.provider "bitbucketServer" -}}
          - name: DRONE_STASH_SERVER
            value: {{ .Values.sourceControl.bitbucketServer.server }}
          - name: DRONE_GIT_USERNAME
            value: {{ .Values.sourceControl.bitbucketServer.username }}
          - name: DRONE_GIT_PASSWORD
            valueFrom:
              secretKeyRef:
                name: {{ template "drone.sourceControlSecret" . }}
                key: {{ .Values.sourceControl.bitbucketServer.passwordKey }}
          - name: DRONE_STASH_CONSUMER_KEY
            valueFrom:
              secretKeyRef:
                name: {{ template "drone.sourceControlSecret" . }}
                key: {{ .Values.sourceControl.bitbucketServer.consumerKey }}
          - name: DRONE_STASH_PRIVATE_KEY
            value: /etc/bitbucket/key.pem
{{- end -}}
{{- end -}}

{{/*
Check if a valid source control provider has been set
*/}}
{{- define "drone.providerOK" -}}
{{- if .Values.sourceControl.provider -}}
  {{- if eq .Values.sourceControl.provider "github" -}}
    {{- if and .Values.sourceControl.github.server .Values.sourceControl.github.clientID -}}
      true
    {{- end -}}
  {{- else if eq .Values.sourceControl.provider "gitlab" -}}
    {{- if and .Values.sourceControl.gitlab.server .Values.sourceControl.gitlab.clientID -}}
      true
    {{- end -}}
  {{- else if eq .Values.sourceControl.provider "gitea" -}}
    {{- if .Values.sourceControl.gitea.server -}}
      true
    {{- end -}}
  {{- else if eq .Values.sourceControl.provider "gogs" -}}
    {{- if .Values.sourceControl.gogs.server -}}
      true
    {{- end -}}
  {{- else if eq .Values.sourceControl.provider "bitbucketCloud" -}}
    {{- if .Values.sourceControl.bitbucketCloud.clientID -}}
      true
    {{- end -}}
  {{- else if eq .Values.sourceControl.provider "bitbucketServer" -}}
    {{- if and .Values.sourceControl.bitbucketServer.server .Values.sourceControl.bitbucketServer.username -}}
      true
    {{- end -}}
{{- end -}}
{{- end -}}
{{- end -}}
 # deployment-agent.yaml
{{- if and (not .Values.server.kubernetes.enabled) (not .Values.runner.enabled) -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "drone.fullname" . }}-agent
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    component: agent
spec:
  selector:
    matchLabels:
      app: {{ template "drone.name" . }}
      release: "{{ .Release.Name }}"
      component: agent
  replicas: {{ .Values.agent.replicas }}
  template:
    metadata:
      annotations:
        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
{{- if .Values.agent.annotations }}
{{ toYaml .Values.agent.annotations | indent 8 }}
{{- end }}
      labels:
        app: {{ template "drone.name" . }}
        release: "{{ .Release.Name }}"
        component: agent
    spec:
{{- if .Values.agent.schedulerName }}
      schedulerName: "{{ .Values.agent.schedulerName }}"
{{- end }}
{{- if .Values.agent.affinity }}
      affinity:
{{ toYaml .Values.agent.affinity | indent 8 }}
{{- end }}
{{- if .Values.agent.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.agent.nodeSelector | indent 8 }}
{{- end }}
{{- with .Values.agent.tolerations }}
      tolerations:
        {{- toYaml . | nindent 6 }}
{{- end }}
      serviceAccountName: {{ template "drone.serviceAccountName" . }}
      containers:
      - name: agent
        image: "{{ .Values.images.agent.repository }}:{{ .Values.images.agent.tag }}"
        imagePullPolicy: {{ .Values.images.agent.pullPolicy }}
        ports:
        - name: http
          containerPort: 3000
          protocol: TCP
        env:
          - name: DRONE_RPC_SERVER
            value: "{{ template "drone.rpcServer" . }}"
          - name: DRONE_RPC_SECRET
            valueFrom:
              secretKeyRef:
                name: {{ template "drone.fullname" . }}
                key: secret
{{- if .Values.dind.enabled }}
          - name: DOCKER_HOST
            value: tcp://localhost:2375
{{- end }}
          {{- range $key, $value := .Values.agent.env }}
          - name: {{ $key }}
            value: {{ $value | quote }}
          {{- end }}
        resources:
{{ toYaml .Values.agent.resources | indent 10 }}
{{- if not .Values.dind.enabled }}
        securityContext:
          privileged: true
        volumeMounts:
          - mountPath: /var/run/docker.sock
            name: docker-socket
      {{- with .Values.agent.volumeMounts }}
          {{- toYaml . | nindent 10 }}
      {{- end }}
      volumes:
        - name: docker-socket
          hostPath:
            path: /var/run/docker.sock
{{- else }}
      {{- with .Values.agent.volumeMounts }}
        volumeMounts:
          {{- toYaml . | nindent 10 }}
      {{- end }}
      - name: dind
        image: "{{ .Values.images.dind.repository }}:{{ .Values.images.dind.tag }}"
        imagePullPolicy: {{ .Values.images.dind.pullPolicy }}
{{- if .Values.dind.command }}
        command: {{ .Values.dind.command }}
{{ end }}
{{- if .Values.dind.args }}
        args: {{ .Values.dind.args }}
{{ end }}
        env:
        - name: DOCKER_DRIVER
          value: {{ .Values.dind.driver }}
        {{ range $key, $value := .Values.dind.env }}
        - name: {{ $key }}
          value: {{ $value | quote }}
        {{ end }}
        securityContext:
          privileged: true
        resources:
{{ toYaml .Values.dind.resources | indent 10 }}
        volumeMounts:
          - name: docker-graph-storage
            mountPath: /var/lib/docker
      {{- with .Values.dind.volumeMounts }}
          {{- toYaml . | nindent 10 }}
      {{- end }}
      volumes:
      - name: docker-graph-storage
        emptyDir: {}
{{- end }}
    {{- with .Values.agent.volumes }}
        {{- toYaml . | nindent 6 }}
    {{- end }}
{{- end -}}
 # deployment-runner.yaml
{{- if and (not .Values.server.kubernetes.enabled) .Values.runner.enabled -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "drone.fullname" . }}-runner
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    component: runner
spec:
  selector:
    matchLabels:
      app: {{ template "drone.name" . }}
      release: "{{ .Release.Name }}"
      component: runner
  replicas: {{ .Values.runner.replicas }}
  template:
    metadata:
{{- if .Values.runner.annotations }}
      annotations:
{{ toYaml .Values.runner.annotations | indent 8 }}
{{- end }}
      labels:
        app: {{ template "drone.name" . }}
        release: "{{ .Release.Name }}"
        component: runner
    spec:
{{- if .Values.runner.schedulerName }}
      schedulerName: "{{ .Values.runner.schedulerName }}"
{{- end }}
{{- if .Values.runner.affinity }}
      affinity:
{{ toYaml .Values.runner.affinity | indent 8 }}
{{- end }}
{{- if .Values.runner.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.runner.nodeSelector | indent 8 }}
{{- end }}
{{- with .Values.runner.tolerations }}
      tolerations:
        {{- toYaml . | nindent 6 }}
{{- end }}
      serviceAccountName: {{ template "drone.pipelineServiceAccount" . }}
      containers:
      - name: runner
        image: "{{ .Values.images.runner.repository }}:{{ .Values.images.runner.tag }}"
        imagePullPolicy: {{ .Values.images.runner.pullPolicy }}
        env:
          - name: DRONE_LOGS_DEBUG
            value: {{ .Values.runner.logs.debug | quote }}
          - name: DRONE_LOGS_TRACE
            value: {{ .Values.runner.logs.trace | quote }}
          - name: DRONE_LOGS_COLOR
            value: "false"
          - name: DRONE_LOGS_PRETTY
            value: "false"
          - name: DRONE_LOGS_TEXT
            value: "true"
          - name: DRONE_RPC_PROTO
            value: {{ .Values.server.rpcProtocol }}
          - name: DRONE_RPC_HOST 
            value: "{{ template "drone.fullname" . }}"
          - name: DRONE_RPC_SECRET
            valueFrom:
              secretKeyRef:
                name: {{ template "drone.fullname" . }}
                key: secret
          - name: DRONE_NAMESPACE_DEFAULT
            value: {{ default .Release.Namespace .Values.runner.namespace }}
        {{- if .Values.secrets.enabled }}
          - name: DRONE_SECRET_PLUGIN_ENDPOINT
            value: http://{{ template "drone.fullname" . }}-secrets:{{ .Values.secrets.service.httpPort }}
          - name: DRONE_SECRET_PLUGIN_TOKEN
            valueFrom:
              secretKeyRef:
                name: {{ template "drone.fullname" . }}
                key: secret
        {{- end }}
          {{- range $key, $value := .Values.runner.env }}
          - name: {{ $key }}
            value: {{ $value | quote }}
          {{- end }}
        resources:
{{ toYaml .Values.runner.resources | indent 10 }}
{{- end }} # deployment-secrets.yaml
{{- if and (not .Values.server.kubernetes.enabled) .Values.runner.enabled .Values.secrets.enabled -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "drone.fullname" . }}-secrets
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    component: secrets
spec:
  selector:
    matchLabels:
      app: {{ template "drone.name" . }}
      release: "{{ .Release.Name }}"
      component: secrets
  replicas: {{ .Values.secrets.replicas }}
  template:
    metadata:
{{- if .Values.secrets.annotations }}
      annotations:
{{ toYaml .Values.secrets.annotations | indent 8 }}
{{- end }}
      labels:
        app: {{ template "drone.name" . }}
        release: "{{ .Release.Name }}"
        component: secrets
    spec:
{{- if .Values.secrets.schedulerName }}
      schedulerName: "{{ .Values.secrets.schedulerName }}"
{{- end }}
{{- if .Values.secrets.affinity }}
      affinity:
{{ toYaml .Values.secrets.affinity | indent 8 }}
{{- end }}
{{- if .Values.secrets.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.secrets.nodeSelector | indent 8 }}
{{- end }}
{{- with .Values.secrets.tolerations }}
      tolerations:
        {{- toYaml . | nindent 6 }}
{{- end }}
      serviceAccountName: {{ template "drone.serviceAccountName" . }}
      containers:
      - name: secrets
        image: {{ .Values.images.secrets.repository }}:{{ .Values.images.secrets.tag }}
        imagePullPolicy: {{ .Values.images.secrets.pullPolicy }}
        resources:
          {{ toYaml .Values.secrets.resources | indent 10 }}
        ports:
        - name: http
          containerPort: {{ .Values.secrets.httpPort }}
          protocol: TCP
        livenessProbe:
          initialDelaySeconds: 2
          periodSeconds: 20
          tcpSocket:
            port: http
        env:
        - name: DEBUG
          value: {{ .Values.secrets.logs.debug | quote }}
        - name: KUBERNETES_NAMESPACE
          value: {{ .Release.Namespace }}
        - name: SERVER_ADDRESS
          value: :{{ .Values.secrets.httpPort }}
        - name: SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: {{ template "drone.fullname" . }}
              key: secret
{{- end }}
 # deployment-server.yaml
{{- if eq (include "drone.providerOK" .) "true" }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "drone.fullname" . }}-server
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    component: server
spec:
  selector:
    matchLabels:
      app: {{ template "drone.name" . }}
      release: "{{ .Release.Name }}"
      component: server
  replicas: 1
  template:
    metadata:
      annotations:
        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
{{- if .Values.metrics.prometheus.enabled }}
        prometheus.io/scrape: "true"
        prometheus.io/port: "8000"
{{- end }}
{{- if .Values.server.annotations }}
{{ toYaml .Values.server.annotations | indent 8 }}
{{- end }}
      labels:
        app: {{ template "drone.name" . }}
        release: "{{ .Release.Name }}"
        component: server
    spec:
{{- if .Values.server.schedulerName }}
      schedulerName: "{{ .Values.server.schedulerName }}"
{{- end }}
{{- if .Values.server.affinity }}
      affinity:
{{ toYaml .Values.server.affinity | indent 8 }}
{{- end }}
{{- if .Values.server.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.server.nodeSelector | indent 8 }}
{{- end }}
{{- with .Values.server.tolerations }}
      tolerations:
        {{- toYaml . | nindent 6 }}
{{- end }}
      serviceAccountName: {{ template "drone.serviceAccountName" . }}
{{- if .Values.images.server.pullSecret }}
      imagePullSecrets:
        - name: {{ .Values.images.server.pullSecret }}
{{- end }}
      containers:
      - name: server
        image: "{{ .Values.images.server.repository }}:{{ .Values.images.server.tag }}"
        imagePullPolicy: {{ .Values.images.server.pullPolicy }}
        env:
        {{- if (or .Values.licenseKey .Values.licenseKeySecret) }}
          - name: DRONE_LICENSE
            value: "/etc/drone.key"
        {{- end }}
        {{- if .Values.server.kubernetes.enabled }}
          - name: DRONE_KUBERNETES_ENABLED
            value: "true"
          - name: DRONE_KUBERNETES_NAMESPACE
            value: {{ default .Release.Namespace .Values.server.kubernetes.namespace }}
          - name: DRONE_KUBERNETES_SERVICE_ACCOUNT
            value: {{ template "drone.pipelineServiceAccount" . }}
        {{- else }}
          - name: DRONE_AGENTS_ENABLED
            value: "true"
        {{- end }}
          - name: DRONE_GIT_ALWAYS_AUTH
            value: {{ .Values.server.alwaysAuth | quote }}
          - name: DRONE_SERVER_HOST
          {{- if hasKey .Values.server "host" }}
            value: "{{ .Values.server.host }}"
          {{- else }}
            value: "{{ template "drone.fullname" . }}"
          {{- end }}
          - name: DRONE_SERVER_PORT
            value: ":{{ .Values.server.httpPort }}"
          - name: DRONE_RPC_PROTO
            value: "{{ .Values.server.rpcProtocol }}"
          - name: DRONE_RPC_HOST
            value: {{ template "drone.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.httpPort }}
          - name: DRONE_SERVER_PROTO
            value: {{ .Values.server.protocol }}
          - name: DRONE_DATABASE_DRIVER
            value: {{ .Values.server.database.driver }}
          - name: DRONE_DATABASE_DATASOURCE
            value: {{ .Values.server.database.dataSource }}
          - name: DRONE_LOGS_COLOR
            value: {{ .Values.server.logs.color | quote }}
          - name: DRONE_LOGS_DEBUG
            value: {{ .Values.server.logs.debug | quote }}
          - name: DRONE_LOGS_PRETTY
            value: {{ .Values.server.logs.pretty | quote }}
          - name: DRONE_LOGS_TRACE
            value: {{ .Values.server.logs.trace | quote }} 
          - name: DRONE_LOGS_TEXT
            value: {{ .Values.server.logs.text | quote }} 
          {{- if .Values.server.adminUser }}
          - name: DRONE_USER_CREATE
            value: username:{{ .Values.server.adminUser }},machine:false,admin:true
          {{- end }}
          - name: DRONE_RPC_SECRET
            valueFrom:
              secretKeyRef:
                name: {{ template "drone.fullname" . }}
                key: secret
          {{- range $key, $value := .Values.server.env }}
          - name: {{ $key }}
            value: {{ $value | quote }}
          {{- end }}
          {{ template "drone.providerEnvs" . }}
          {{- range $secret, $keys := .Values.server.envSecrets }}
          {{- range $keys }}
          - name: {{ . }}
            valueFrom:
              secretKeyRef:
                name: {{ $secret }}
                key: {{ . | quote }}
          {{- end }}
          {{- end }}
        ports:
        - name: http
          containerPort: {{ .Values.server.httpPort }}
          protocol: TCP
        - name: https
          containerPort: 443
          protocol: TCP
        - name: grpc
          containerPort: 9000
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /
            port: http
        resources:
{{ toYaml .Values.server.resources | indent 10 }}
        volumeMounts:
        {{ if eq .Values.sourceControl.provider "bitbucketServer" -}}
        - name: bitbucket-private-key
          mountPath: /etc/bitbucket
          readOnly: true
        {{ end }}
        {{ if (or .Values.licenseKey .Values.licenseKeySecret) -}}
        - name: license-key
          mountPath: /etc/drone.key
          subPath: drone.key
          readOnly: true
        {{ end }}
        - name: data
          mountPath: /var/lib/drone
{{- with .Values.server.extraContainers }}
{{ tpl . $ | indent 6 }}
{{- end }}
      volumes:
      {{ if eq .Values.sourceControl.provider "bitbucketServer" -}}
      - name: bitbucket-private-key
        secret:
          secretName: {{ template "drone.sourceControlSecret" . }}
          items:
            - key: {{ .Values.sourceControl.bitbucketServer.privateKey }}
              path: key.pem
      {{ end -}}
      {{ if (or .Values.licenseKey .Values.licenseKeySecret) -}}
      - name: license-key
        secret:
          secretName: {{ template "drone.licenseKeySecret" . }}
          items:
            - key: license-key
              path: drone.key
      {{ end -}}
      - name: data
      {{- if .Values.persistence.enabled }}
        persistentVolumeClaim:
          claimName: {{ .Values.persistence.existingClaim | default (include "drone.fullname" .) }}
      {{- else }}
        emptyDir: {}
      {{- end -}}
      {{- if .Values.server.securityContext }}
      securityContext:
{{ toYaml .Values.server.securityContext | indent 8 }}
      {{- end }}
{{- with .Values.server.extraVolumes }}
{{ tpl . $ | indent 6 }}
{{- end }}
{{ end }}
 # ingress.yaml
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "drone.fullname" . }}
{{- $httpPort := .Values.service.httpPort }}
apiVersion: {{ template "drone.ingress.apiVersion" . }}
kind: Ingress
metadata:
  annotations:
  {{- range $key, $value := .Values.ingress.annotations }}
    {{ $key }}: {{ $value | quote }}
  {{- end }}
  labels:
    app: {{ template "drone.name" . }}
    heritage: "{{ .Release.Service }}"
    release: "{{ .Release.Name }}"
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
  name: {{ template "drone.fullname" . }}
spec:
  rules:
  {{- range .Values.ingress.hosts }}
    - host: {{ . }}
      http:
        paths:
        {{- if $.Values.ingress.path }}
          - path: {{ $.Values.ingress.path }}
        {{- else if index $.Values.ingress "annotations" }}
          {{- if eq (index $.Values.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" "istio" }}
          - path: /*
          {{- else }}{{/* Has annotations but ingress class is not "gce" nor "alb" nor "istio" */}}
          - path: /
          {{- end }}
        {{- else }}{{/* Has no annotations */}}
          - path: /
        {{- end }}
            backend:
              serviceName: {{ $fullName }}
              servicePort: {{ $httpPort }}
  {{- end -}}
  {{- if .Values.ingress.tls }}
  tls:
{{ toYaml .Values.ingress.tls | indent 4 }}
  {{- end -}}
{{- end -}}
 # namespace-pipeline.yaml
{{- if hasKey .Values.server.kubernetes "namespace" -}}
apiVersion: v1
kind: Namespace
metadata:
  name: {{ .Values.server.kubernetes.namespace }}
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    component: server
{{- end -}}
 # pvc.yaml
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: {{ template "drone.fullname" . }}
spec:
  accessModes:
    - {{ .Values.persistence.accessMode | quote }}
  resources:
    requests:
      storage: {{ .Values.persistence.size | quote }}
{{- if .Values.persistence.storageClass }}
{{- if (eq "-" .Values.persistence.storageClass) }}
  storageClassName: ""
{{- else }}
  storageClassName: "{{ .Values.persistence.storageClass }}"
{{- end }}
{{- end }}
{{- end }}
 # role-binding-pipeline.yaml
{{ if and .Values.rbac.create (or .Values.server.kubernetes.enabled .Values.runner.enabled ) -}}
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
kind: ClusterRoleBinding
metadata:
  name: {{ template "drone.fullname" . }}-pipeline
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
subjects:
  - kind: ServiceAccount
    name: {{ template "drone.pipelineServiceAccount" . }}
    namespace: {{ default .Release.Namespace .Values.server.kubernetes.namespace }}
roleRef:
  kind: ClusterRole
  name: {{ template "drone.fullname" . }}-pipeline
  apiGroup: rbac.authorization.k8s.io
{{- end -}}
 # role-binding-secrets.yaml
{{ if and .Values.rbac.create (not .Values.server.kubernetes.enabled) .Values.runner.enabled -}}
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
kind: RoleBinding
metadata:
  name: {{ template "drone.fullname" . }}-secrets
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ template "drone.fullname" . }}-secrets
subjects:
- kind: ServiceAccount
  name: {{ template "drone.fullname" . }}-secrets
  namespace: {{ .Release.Namespace }}
{{ end }}
 # role-binding.yaml
{{ if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
kind: RoleBinding
metadata:
  name: {{ template "drone.fullname" . }}
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ template "drone.fullname" . }}
subjects:
- kind: ServiceAccount
  name: {{ template "drone.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
{{ end }}
 # role-pipeline.yaml
{{ if and .Values.rbac.create (or .Values.server.kubernetes.enabled .Values.runner.enabled ) -}}
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
kind: ClusterRole
metadata:
  name: {{ template "drone.fullname" . }}-pipeline
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
rules:
  - apiGroups:
      - extensions
    resources:
      - deployments
    verbs:
      - get
      - list
      - watch
      - patch
      - update
  - apiGroups:
      - ""
    resources:
      - namespaces
      - configmaps
      - secrets
      - pods
      - services
    verbs:
      - create
      - delete
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - pods/log
    verbs:
      - get
{{ end }}
 # role-secrets.yaml
{{ if and .Values.serviceAccount.create (not .Values.server.kubernetes.enabled) .Values.runner.enabled -}}
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
kind: Role
metadata:
  name: {{ template "drone.fullname" . }}-secrets
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - create
      - delete
      - get
      - list
      - watch
{{ end }}
 # role.yaml
{{ if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
kind: Role
metadata:
  name: {{ template "drone.fullname" . }}
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
rules:
  - apiGroups:
      - batch
    resources:
      - jobs
    verbs:
      - "*"
  - apiGroups:
      - extensions
    resources:
      - deployments
    verbs:
      - get
      - list
      - patch
      - update
{{ end }}
 # secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "drone.fullname" . }}
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
type: Opaque
data:
  {{ if .Values.sharedSecret }}
  secret: "{{ .Values.sharedSecret | b64enc }}"
  {{ else }}
  secret: "{{ randAlphaNum 24 | b64enc }}"
  {{ end }}
---
{{ if not .Values.sourceControl.secret -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "drone.sourceControlSecret" . }}
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
type: Opaque
data:
  {{if .Values.sourceControl.provider}}
  {{ if eq .Values.sourceControl.provider "github" }}
  {{ .Values.sourceControl.github.clientSecretKey }}: {{ .Values.sourceControl.github.clientSecretValue | b64enc | quote }}
  {{- else if  eq .Values.sourceControl.provider "gitlab" -}}
  {{ .Values.sourceControl.gitlab.clientSecretKey }}: {{ .Values.sourceControl.gitlab.clientSecretValue | b64enc | quote }}
  {{- else if  eq .Values.sourceControl.provider "gitea" -}}
  {{ .Values.sourceControl.gitea.clientSecretKey }}: {{ .Values.sourceControl.gitea.clientSecretValue | b64enc | quote }}
  {{- else if eq .Values.sourceControl.provider "bitbucketCloud" -}}
  {{ .Values.sourceControl.bitbucketCloud.clientSecretKey }}: {{ .Values.sourceControl.bitbucketCloud.clientSecretValue | b64enc | quote }}
  {{ end }}
  {{ end }}
{{- end }}
---
{{- if and (not .Values.licenseKeySecret) .Values.licenseKey -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "drone.licenseKeySecret" }}
  labels:
    app: {{ template "drone.name" }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
type: Opaque
data:
  license-key: {{ .Values.licenseKey | b64enc | quote }}
{{- end }}
 # service-account-pipeline.yaml
{{ if and .Values.serviceAccount.create (or .Values.server.kubernetes.enabled .Values.runner.enabled ) -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "drone.pipelineServiceAccount" . }}
  namespace: {{ default .Release.Namespace .Values.server.kubernetes.namespace }}
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
{{ end }}
 # service-account-secrets.yaml
{{- if and (not .Values.server.kubernetes.enabled) .Values.runner.enabled .Values.secrets.enabled .Values.runner.enabled -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "drone.fullname" . }}-secrets
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
{{- end -}} # service-account.yaml
{{ if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "drone.serviceAccountName" . }}
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
{{ end }}
 # service-secrets.yaml
{{- if and (not .Values.server.kubernetes.enabled) .Values.runner.enabled .Values.secrets.enabled .Values.runner.enabled -}}
apiVersion: v1
kind: Service
metadata:
  name: {{ template "drone.fullname" . }}-secrets
{{- if .Values.secrets.service.annotations }}
  annotations:
  {{- range $key, $value := .Values.secrets.service.annotations }}
    {{ $key }}: {{ $value | quote }}
  {{- end }}
{{- end }}
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  type: ClusterIP
  ports:
  - name: http
    port: {{ .Values.secrets.service.httpPort }}
    targetPort: {{ .Values.secrets.httpPort }}
  selector:
    app: {{ template "drone.name" . }}
    release: {{ .Release.Name | quote }}
    component: secrets
{{- end -}} # service.yaml
apiVersion: v1
kind: Service
metadata:
  name: {{ template "drone.fullname" . }}
  annotations:
  {{- range $key, $value := .Values.service.annotations }}
    {{ $key }}: {{ $value | quote }}
  {{- end }}
  labels:
    app: {{ template "drone.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  type: {{ .Values.service.type }}
  {{- if and (hasKey .Values.service "loadBalancerIP") (eq .Values.service.type "LoadBalancer") }}
  loadBalancerIP: {{ .Values.service.loadBalancerIP }}
  {{- end }}
  ports:
  - name: http
    port: {{ .Values.service.httpPort }}
    targetPort: {{ .Values.server.httpPort }}
{{- if hasKey .Values.service "nodePort" }}
    nodePort: {{ .Values.service.nodePort }}
{{- end }}
{{- if .Values.service.exposeGRPC }}
  - name: grpc
    port: 9000
    targetPort: 9000
{{- end }}
  selector:
    app: {{ template "drone.name" . }}
    release: {{ .Release.Name | quote }}
    component: server

images:
  ## The official drone (server) image, change tag to use a different version.
  ## ref: https://hub.docker.com/r/drone/drone/tags/
  ##
  server:
    repository: "docker.io/drone/drone"
    tag: 1.6.5
    pullPolicy: IfNotPresent

  ## The official drone (agent) image, change tag to use a different version.
  ## ref: https://hub.docker.com/r/drone/agent/tags/
  ##
  agent:
    repository: "docker.io/drone/agent"
    tag: 1.6.2
    pullPolicy: IfNotPresent

  ## The official docker (dind) image, change tag to use a different version.
  ## ref: https://hub.docker.com/r/library/docker/tags/
  ##
  dind:
    repository: "docker.io/library/docker"
    tag: 18.06.1-ce-dind
    pullPolicy: IfNotPresent

  ## The official drone (runner-kubernetes) image, change tag to use a different version.
  ## ref: https://hub.docker.com/r/drone/drone-runner-kube/tags/
  ##
  runner:
    repository: "docker.io/drone/drone-runner-kube"
    tag: 1.0.0-beta.2
    pullPolicy: IfNotPresent

  secrets:
    repository: "robotinfra/drone-kubernetes-secrets"
    tag: 0c5746b
    pullPolicy: IfNotPresent

service:
  httpPort: 80

  ## If service.type is not set to NodePort, the following statement
  ## will be ignored.
  ##
  # nodePort: 32015

  ## Service type can be set to ClusterIP, NodePort or LoadBalancer.
  ##
  type: ClusterIP

  ## Specify a load balancer IP address to use if your provider supports it.
  # loadBalancerIP:

  ## Drone Service annotations
  ##
  # annotations:
  #   service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
  #   service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:xx-xxxx-x:xxxxxxxxxxx:certificate/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
  #   external-dns.alpha.kubernetes.io/hostname: drone.domain.tld.

  ## set to true if you want to expose drone's GRPC via the service (for external access)
  exposeGRPC: false

ingress:
  ## If true, Drone Ingress will be created.
  ##
  enabled: false

  ## Drone Ingress annotations
  ##
  # annotations:
  #   kubernetes.io/ingress.class: nginx
  #   kubernetes.io/tls-acme: 'true'
  ## Drone hostnames must be provided if Ingress is enabled
  ##
  # hosts:
  #   - drone.domain.io
  ## Drone Ingress TLS configuration secrets
  ## Must be manually created in the namespace
  ##
  # tls:
  #   - secretName: drone-tls
  #     hosts:
  #       - drone.domain.io

sourceControl:
  ## your source control provider: github,gitlab,gitea,gogs,bitbucketCloud,bitbucketServer
  provider:
  ## secret containing your source control provider secrets, keys provided below.
  ## if left blank will assume a secret based on the release name of the chart.
  secret:
  ## Fill in the correct values for your chosen source control provider
  ## Any key in this list with the suffix `Key` will be fetched from the
  ## secret named above, if not provided the secret it will be created as
  ## `<fullName>-source-control` using for the key "ClientSecretKey" and
  # "clientSecretValue" for the value. Be awere to not leak shis file with your password
  github:
    clientID:
    clientSecretKey: clientSecret
    clientSecretValue:
    server: https://github.com
  gitlab:
    clientID:
    clientSecretKey: clientSecret
    clientSecretValue:
    server:
  gitea:
    clientID:
    clientSecretKey: clientSecret
    clientSecretValue:
    server:
  gogs:
    server:
  bitbucketCloud:
    clientID:
    clientSecretKey: clientSecret
    clientSecretValue:
  bitbucketServer:
    server:
    consumerKey: consumerKey
    privateKey: privateKey
    username:
    passwordKey: password

server:
  ## If not set, it will be autofilled with the cluster host.
  ## Host shoud be just the hostname.
  ##
  # host: "drone.domain.io"

  ## protocol should be http or https
  protocol: http
  database:
    driver: "sqlite3"
    dataSource: "/var/lib/drone/drone.sqlite"
  logs:
    color: false
    debug: false
    pretty: false
    trace: false
    text: true

  ## http port
  ## Set to > 1024 if you want to run the pod as non-root user
  httpPort: 80

  ## rpcProtocol for rpc connection to the server should be http or https
  rpcProtocol: http

  ## Initial admin user
  ## Leaving this blank may make it impossible to log into drone.
  ## Set to a valid oauth user from your git/oauth server
  ## For more complex user creation you can use env variables below instead.
  adminUser:

  ## Configures Drone to authenticate when cloning public repositories. This is only required
  ## when your source code management system (e.g. GitHub Enterprise) has private mode enabled.
  alwaysAuth: false

  ## Configures drone to use legacy kubernetes runner to run pipelines rather than agents
  ## if enabled will not deploy any agents.
  kubernetes:
    ## set to true if you want drone to use old kubernetes legacy to run pipelines
    enabled: true
    ## you can run pipeline jobs in another namespace, if you choose to do this
    ## you'll need to create that namespace manually.
    # namespace:
    ## alternative service account to create to create drone pipelines. this account
    ## will be given cluster-admin rights.
    ## if not set the rights will be given to the default drone service account name.
    # pipelineServiceAccount:

  ## Drone server configuration.
  ## Values in here get injected as environment variables.
  ## You can set up remote database servers etc using environment
  ## variables.
  ## ref: https://docs.drone.io/reference/server/
  ##
  env:
  ## Secret environment variables are configured in `server.envSecrets`.
  ## Each item in `server.envSecrets` references a Kubernetes Secret.
  ## These Secrets should be created before they are referenced.
  ##
  # envSecrets:
  #   # The name of a Kubernetes Secret
  #   drone-server-secrets:
  #     # A list of Secret keys to include as environment variables
  #     - DRONE_GITHUB_SECRET

  ## Additional server annotations.
  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  ##
  annotations: {}

  ## CPU and memory limits for drone server
  ##
  resources: {}
  #  requests:
  #    memory: 32Mi
  #    cpu: 40m
  #  limits:
  #    memory: 2Gi
  #    cpu: 1

  ## Use an alternate scheduler, e.g. "stork".
  ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
  ##
  # schedulerName:

  ## Pod scheduling preferences.
  ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
  ##
  affinity: {}

  ## Node labels for pod assignment
  ## ref: https://kubernetes.io/docs/user-guide/node-selection
  ##
  nodeSelector: {}

  ## Node taints to tolerate
  ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  ##
  tolerations: []

  ## securityContext for drone server
  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
  securityContext: {}

  ## additional siecar containers, e. g. for a database proxy, such as Google's cloudsql-proxy.
  ## ex: https://github.com/kubernetes/charts/tree/master/stable/keycloak
  ##
  extraContainers: |

  ## additional volumes, e. g. for secrets used in an extraContainers.
  ##
  extraVolumes: |

## Kubernetes runner is the new method to run pipelines, might requires changes to `.drone.yaml` files
runner:
  # requires server.kubernetes.enabled=`false`
  enabled: false

  logs:
    debug: false

  ## Number of drone kube-runner replicas
  replicas: 1

  ## Additional kube-runner annotations.
  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  ##
  annotations: {}

  ## Liveness and readiness probe values
  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
  ## drone runner does not currently have a health endpoint to check against.
  livenessProbe: {}
  readinessProbe: {}

  ## Use an alternate scheduler, e.g. "stork".
  ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
  ##
  # schedulerName:

  ## Pod scheduling preferences.
  ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
  ##
  affinity: {}

  ## Node labels for pod assignment
  ## ref: https://kubernetes.io/docs/user-guide/node-selection
  ##
  nodeSelector: {}

  ## Node taints to tolerate
  ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  ##
  tolerations: []

  ## Drone kube-runner configuration.
  ## Values in here get injected as environment variables to the kube-runner
  ## Ref: https://kube-runner.docs.drone.io/installation/reference/
  ##
  env: {}

  ## CPU and memory limits for drone kube-runner
  ##
  resources: {}
  #  requests:
  #    memory: 32Mi
  #    cpu: 40m
  #  limits:
  #    memory: 2Gi
  #    cpu: 1

# kubernetes secrets plugins container
secrets:
  # runner.enabled must also be `true`
  enabled: false
  service:
    httpPort: 80
    # annotations:

  logs:
    debug: false

  httpPort: 3000

  ## Number of drone kube-runner replicas
  replicas: 1

  ## Additional kubernetes secrets annotations.
  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  ##
  annotations: {}

  ## Liveness and readiness probe values
  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
  ## drone runner does not currently have a health endpoint to check against.
  livenessProbe: {}
  readinessProbe: {}

  ## Use an alternate scheduler, e.g. "stork".
  ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
  ##
  # schedulerName:

  ## Pod scheduling preferences.
  ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
  ##
  affinity: {}

  ## Node labels for pod assignment
  ## ref: https://kubernetes.io/docs/user-guide/node-selection
  ##
  nodeSelector: {}

  ## Node taints to tolerate
  ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  ##
  tolerations: []

  ## CPU and memory limits for drone kube-runner
  ##
  resources: {}
  #  requests:
  #    memory: 32Mi
  #    cpu: 40m
  #  limits:
  #    memory: 2Gi
  #    cpu: 1

agent:
  ## Drone agent configuration.
  ## Values in here get injected as environment variables.
  ## ref: https://docs.drone.io/reference/agent/
  ##
  env:
    # DRONE_LOGS_DEBUG: "false"

  ## Number of drone agent replicas
  replicas: 1

  ## Additional agent annotations.
  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  ##
  annotations: {}

  ## Additional volumes e.g. for shared caching between agents on different nodes or
  ## shared cache between agents on the same node when using dind or
  ## for a global docker login config as per
  ## Option 2 ref: https://discourse.drone.io/t/how-to-pull-private-images-with-1-0/3155
  ## Note: Option 2 also requires DRONE_DOCKER_CONFIG: /root/.docker/config.json env var in agent
  ## NB: This will make the credentials available globally to all builds and all repositories
  # volumes:
  # - name: docker-config
  #   secret:
  #     defaultMode: 420
  #     items:
  #     - key: .dockerconfigjson
  #       path: config.json
  #     secretName: drone-docker-config
  # - name: persistent-data
  #   persistentVolumeClaim:
  #     claimName: drone-agent-pvc
  # - name: cache
  #   hostPath:
  #     path: /drone-cache
  #     type: Directory

  ## Volume mount into agent container
  # volumeMounts:
  # - name: docker-config
  #   mountPath: /root/.docker
  #   readOnly: true

  ## CPU and memory limits for drone agent
  ##
  resources: {}
  #  requests:
  #    memory: 32Mi
  #    cpu: 40m
  #  limits:
  #    memory: 2Gi
  #    cpu: 1

  ## Liveness and readiness probe values
  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
  ## drone agent does not currently have a health endpoint to check against.
  livenessProbe: {}
  readinessProbe: {}

  ## Use an alternate scheduler, e.g. "stork".
  ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
  ##
  # schedulerName:

  ## Pod scheduling preferences.
  ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
  ##
  affinity: {}

  ## Node labels for pod assignment
  ## ref: https://kubernetes.io/docs/user-guide/node-selection
  ##
  nodeSelector: {}

  ## Node taints to tolerate
  ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  ##
  tolerations: []

dind:
  ## Enable or disable DinD
  ## If disabled, the drone agent will spawn docker containers on the host. Pay
  ## attention to the fact that we can't enforce resource constraints in that case.
  ##
  enabled: true

  ## Values in here get injected as environment variables to DinD.
  ## ref: http://readme.drone.io/admin/installation-reference
  ##
  #  env:
  #    DRONE_DEBUG: "false"

  ## Allowing custom command and args to DinD
  ## ref: https://discourse.drone.io/t/docker-mtu-problem/1207
  ##
  #  command: '["/bin/sh"]'
  #  args: '["-c", "dockerd --host=unix:///var/run/docker.sock --host=tcp://127.0.0.1:2375 --mtu=1350"]'

  ## Docker storage driver.
  ## Your DinD instance should be using the same driver as your host.
  ## ref: https://docs.docker.com/engine/userguide/storagedriver/selectadriver/
  ##
  driver: overlay2

  ## Volume mount into dind container
  ## Volumes are defined under agent values.
  # volumeMounts:
  # - mountPath: /root/.docker
  #   name: docker-config
  #   readOnly: true
  # - name: persistent-data
  #   mountPath: /mnt/drone-cache

  ## CPU and memory limits for dind
  ##
  resources: {}
  #  requests:
  #    memory: 32Mi
  #    cpu: 40m
  #  limits:
  #    memory: 2Gi
  #    cpu: 1

## Enable scraping of the /metrics endpoint for Prometheus
metrics:
  prometheus:
    enabled: false

## Enable persistence using Persistent Volume Claims
## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
##
persistence:
  enabled: true

  ## A manually managed Persistent Volume and Claim
  ## Requires persistence.enabled: true
  ## If defined, PVC must be created manually before volume will be bound
  # existingClaim:

  ## rabbitmq data Persistent Volume Storage Class
  ## If defined, storageClassName: <storageClass>
  ## If set to "-", storageClassName: "", which disables dynamic provisioning
  ## If undefined (the default) or set to null, no storageClassName spec is
  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
  ##   GKE, AWS & OpenStack)
  ##
  # storageClass: "-"
  accessMode: ReadWriteOnce
  size: 1Gi

## Uncomment this if you want to set a specific shared secret between
## the agents and servers, otherwise this will be auto-generated.
##
# sharedSecret: supersecret

rbac:
  ## Specifies whether RBAC resources should be created
  create: true
  ## RBAC api version (v1, v1beta1, or v1alpha1)
  apiVersion: v1

serviceAccount:
  ## Specifies whether a ServiceAccount should be created
  create: true
  ## The name of the ServiceAccount to use.
  ## If not set and create is true, a name is generated using the fullname template
  name:
