# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "vault-operator.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "vault-operator.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "vault-operator.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create the name of the service account to use
*/}}
{{- define "vault-operator.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
    {{ default (include "vault-operator.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
    {{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
 # crd.yaml
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: vaultservices.vault.security.coreos.com
  labels:
    app: {{ template "vault-operator.name" . }}
    chart: {{ template "vault-operator.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  group: vault.security.coreos.com
  names:
    kind: VaultService
    listKind: VaultServiceList
    plural: vaultservices
    shortNames:
    - vault
    singular: vaultservice
  scope: Namespaced
  version: v1alpha1
   # deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "vault-operator.fullname" . }}
  labels:
    app: {{ template "vault-operator.name" . }}
    chart: {{ template "vault-operator.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      app: {{ template "vault-operator.name" . }}
      release: {{ .Release.Name }}
  template:
    metadata:
      labels:
        app: {{ template "vault-operator.name" . }}
        release: {{ .Release.Name }}
    spec:
      serviceAccountName: {{ template "vault-operator.serviceAccountName" . }}
      containers:
      - name: {{ .Chart.Name }}
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        command:
        - vault-operator
{{- range $key, $value := .Values.commandArgs }}
        - "--{{ $key }}={{ $value }}"
{{- end }}
        env:
        - name: MY_POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: MY_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        {{- if .Values.livenessProbe.enabled }}
        livenessProbe:
          httpGet:
            path: /readyz
            port: 8080
          initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
          periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
          timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
          successThreshold: {{ .Values.livenessProbe.successThreshold }}
          failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
        {{- end}}
        {{- if .Values.readinessProbe.enabled }}
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8080
          initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
          periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
          timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
          successThreshold: {{ .Values.readinessProbe.successThreshold }}
          failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
        {{- end }}
        resources:
{{ toYaml .Values.resources | indent 12 }}
    {{- with .Values.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
    {{- end }}
 # role-binding.yaml
{{- if .Values.rbac.create }}
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ template "vault-operator.fullname" . }}
  labels:
    app: {{ template "vault-operator.name" . }}
    chart: {{ template "vault-operator.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
subjects:
- kind: ServiceAccount
  name: {{ template "vault-operator.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ template "vault-operator.fullname" . }}
{{- end }}
 # role.yaml
{{- if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ template "vault-operator.fullname" . }}
  labels:
    app: {{ template "vault-operator.name" . }}
    chart: {{ template "vault-operator.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
rules:
- apiGroups:
  - etcd.database.coreos.com
  resources:
  - etcdclusters
  - etcdbackups
  - etcdrestores
  verbs:
  - "*"
- apiGroups:
  - vault.security.coreos.com
  resources:
  - vaultservices
  verbs:
  - "*"
- apiGroups:
  - storage.k8s.io
  resources:
  - storageclasses
  verbs:
  - "*"
- apiGroups:
  - "" # "" indicates the core API group
  resources:
  - pods
  - services
  - endpoints
  - persistentvolumeclaims
  - events
  - configmaps
  - secrets
  verbs:
  - "*"
- apiGroups:
  - apps
  resources:
  - deployments
  verbs:
  - "*"
{{- end }}
 # service-account.yaml
{{- if .Values.serviceAccount.create }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "vault-operator.serviceAccountName" . }}
  labels:
    app: {{ template "vault-operator.name" . }}
    chart: {{ template "vault-operator.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
{{- end }}

## Default values for the image
name: vault-operator
replicaCount: 1
image:
  repository: quay.io/coreos/vault-operator
  tag: 0.1.9
  pullPolicy: IfNotPresent

## Install Default RBAC roles and bindings
rbac:
  create: true

## Service account names and whether to create them
serviceAccount:
  create: true
  name:

resources: {}
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi

## additional command arguments go here; will be translated to `--key=value` form
## e.g., analytics: true
commandArgs: {}

## Configurable health checks against the /readyz endpoint that vault-operator exposes
readinessProbe:
  enabled: false
  initialDelaySeconds: 0
  periodSeconds: 10
  timeoutSeconds: 1
  successThreshold: 1
  failureThreshold: 3
livenessProbe:
  enabled: false
  initialDelaySeconds: 0
  periodSeconds: 10
  timeoutSeconds: 1
  successThreshold: 1
  failureThreshold: 3

nodeSelector: {}

tolerations: []

affinity: {}

###
# All of the config variables related to setting up the etcd-operator
# Disabled by default
# If you want more information about the variables exposed, please visit:
#   https://github.com/kubernetes/charts/tree/master/stable/etcd-operator#configuration
###
etcd-operator:
  enabled: false
  deployments:
    etcdOperator: true
    backupOperator: true
    restoreOperator: true
  serviceAccount:
    etcdOperatorServiceAccount:
      create: true
    backupOperatorServiceAccount:
      create: true
    restoreOperatorServiceAccount:
      create: true
  etcdOperator:
    image:
      tag: v0.9.2
  backupOperator:
    image:
      tag: v0.9.2
  restoreOperator:
    image:
      tag: v0.9.2
