# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "kured.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "kured.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "kured.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create the name of the service account to use
*/}}
{{- define "kured.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
    {{ default (include "kured.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
    {{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}

{{/*
Return the appropriate apiVersion for podsecuritypolicy.
*/}}
{{- define "kured.psp.apiVersion" -}}
{{- if semverCompare "<1.10-0" .Capabilities.KubeVersion.GitVersion -}}
{{- print "extensions/v1beta1" -}}
{{- else -}}
{{- print "policy/v1beta1" -}}
{{- end -}}
{{- end -}}
 # clusterrole.yaml
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "kured.fullname" . }}
  labels:
    app: {{ template "kured.name" . }}
    chart: {{ template "kured.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
rules:
# Allow kured to read spec.unschedulable
# Allow kubectl to drain/uncordon
#
# NB: These permissions are tightly coupled to the bundled version of kubectl; the ones below
# match https://github.com/kubernetes/kubernetes/blob/v1.12.1/pkg/kubectl/cmd/drain.go
#
- apiGroups: [""]
  resources: ["nodes"]
  verbs:     ["get", "patch"]
- apiGroups: [""]
  resources: ["pods"]
  verbs:     ["list","delete","get"]
- apiGroups: ["extensions"]
  resources: ["daemonsets"]
  verbs:     ["get"]
- apiGroups: ["apps"]
  resources: ["daemonsets"]
  verbs:     ["get"]
- apiGroups: [""]
  resources: ["pods/eviction"]
  verbs:     ["create"]
{{- end -}}
 # clusterrolebinding.yaml
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ template "kured.fullname" . }}
  labels:
    app: {{ template "kured.name" . }}
    chart: {{ template "kured.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template "kured.fullname" . }}
subjects:
- kind: ServiceAccount
  name: {{ template "kured.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
{{- end -}}
 # daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: {{ template "kured.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ template "kured.name" . }}
    chart: {{ template "kured.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  updateStrategy:
    type: {{ .Values.updateStrategy }}
  selector:
    matchLabels:
      app: {{ template "kured.name" . }}
      release: {{ .Release.Name }}
  template:
    metadata:
      labels:
        app: {{ template "kured.name" . }}
        release: {{ .Release.Name }}
      {{- if .Values.podAnnotations }}
      annotations:
      {{- range $key, $value := .Values.podAnnotations }}
        {{ $key }}: {{ $value | quote }}
      {{- end }}
      {{- end }}
    spec:
      serviceAccountName: {{ template "kured.serviceAccountName" . }}
      hostPID: true
      restartPolicy: Always
      {{- with .Values.image.pullSecrets }}
      imagePullSecrets:
{{ toYaml . | indent 8 }}
      {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
      {{- end }}
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
      {{- end }}
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            privileged: true # Give permission to nsenter /proc/1/ns/mnt
          resources:
{{ toYaml .Values.resources | indent 12 }}
          command:
            - /usr/bin/kured
          args:
            - --ds-name={{ template "kured.fullname" . }}
            - --ds-namespace={{ .Release.Namespace }}
          {{- range $key, $value := .Values.extraArgs }}
            {{- if $value }}
            - --{{ $key }}={{ $value }}
            {{- else }}
            - --{{ $key }}
            {{- end }}
          {{- end }}
          ports:
            - containerPort: 8080
              name: metrics          
          env:
            # Pass in the name of the node on which this pod is scheduled
            # for use with drain/uncordon operations and lock acquisition
            - name: KURED_NODE_ID
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
      restartPolicy: Always
      {{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
      {{- end }}
 # lock-cronjob.yaml
{{- if .Values.autolock.enabled }}
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: {{ template "kured.fullname" . }}-lock
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ template "kured.name" . }}
    chart: {{ template "kured.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  schedule: {{ .Values.autolock.schedulelock | quote }}
  jobTemplate:
    spec:
      template:
        metadata:
          labels:
            app: {{ template "kured.name" . }}
            chart: {{ template "kured.chart" . }}
            release: {{ .Release.Name }}
            heritage: {{ .Release.Service }}
        spec:
          serviceAccountName: {{ template "kured.serviceAccountName" . }}
          containers:
            - name: {{ template "kured.fullname" . }}-lock
              image: "{{ .Values.autolock.image.repository }}:{{ .Values.autolock.image.tag }}"
              command:
                - kubectl
              args:
                - -n 
                - {{ .Release.Namespace }}
                - annotate
                - ds
                - {{ template "kured.fullname" . }}
                - weave.works/kured-node-lock={"nodeID":"manual"}
          restartPolicy: Never
      backoffLimit: 1
{{- end -}}
 # podsecuritypolicy.yaml
{{- if .Values.podSecurityPolicy.create}}
apiVersion: {{ template "kured.psp.apiVersion" . }}
kind: PodSecurityPolicy
metadata:
  name: {{ template "kured.fullname" . }}
  labels:
    app: {{ template "kured.name" . }}
    chart: {{ template "kured.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  privileged: true
  hostPID: true
  allowedCapabilities: ['*']
  fsGroup:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes: ['*']
{{- end }}
 # role.yaml
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: {{ .Release.Namespace }}
  name: {{ template "kured.fullname" . }}
  labels:
    app: {{ template "kured.name" . }}
    chart: {{ template "kured.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
rules:
  # Allow kured to lock/unlock itself
  - apiGroups:     ["extensions"]
    resources:     ["daemonsets"]
    resourceNames: ["{{ template "kured.fullname" . }}"]
    verbs:         ["update", "patch"]
  - apiGroups:     ["apps"]
    resources:     ["daemonsets"]
    resourceNames: ["{{ template "kured.fullname" . }}"]
    verbs:         ["update"]
{{- if .Values.podSecurityPolicy.create }}
  - apiGroups:     ["extensions"]
    resources:     ["podsecuritypolicies"]
    resourceNames: ["{{ template "kured.fullname" . }}"]
    verbs:         ["use"]
{{- end }}

{{- end -}}
 # rolebinding.yaml
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: {{ .Release.Namespace }}
  name: {{ template "kured.fullname" . }}
  labels:
    app: {{ template "kured.name" . }}
    chart: {{ template "kured.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
subjects:
- kind: ServiceAccount
  namespace: {{ .Release.Namespace }}
  name: {{ template "kured.serviceAccountName" . }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ template "kured.fullname" . }}
{{- end -}}
 # serviceaccount.yaml
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "kured.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
{{- end -}}
 # unlock-cronjob.yaml
{{- if .Values.autolock.enabled }}
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: {{ template "kured.fullname" . }}-unlock
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ template "kured.name" . }}
    chart: {{ template "kured.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  schedule: {{ .Values.autolock.scheduleUnlock | quote }}
  jobTemplate:
    spec:
      template:
        metadata:
          labels:
            app: {{ template "kured.name" . }}
            chart: {{ template "kured.chart" . }}
            release: {{ .Release.Name }}
            heritage: {{ .Release.Service }}
        spec:
          serviceAccountName: {{ template "kured.serviceAccountName" . }}
          containers:
            - name: {{ template "kured.fullname" . }}-unlock
              image: "{{ .Values.autolock.image.repository }}:{{ .Values.autolock.image.tag }}"
              command:
                - kubectl
              args:
                - -n 
                - {{ .Release.Namespace }}
                - annotate
                - ds
                - {{ template "kured.fullname" . }}
                - weave.works/kured-node-lock-
          restartPolicy: Never
      backoffLimit: 1
{{- end -}}

image:
  repository: weaveworks/kured
  tag: 1.4.0
  pullPolicy: IfNotPresent
  pullSecrets: []

extraArgs: {}

rbac:
  create: true

podSecurityPolicy:
  create: false

serviceAccount:
  create: true
  name:

autolock:
  enabled: false
  image:
    repository: docker.io/bitnami/kubectl
    tag: 1.17.5
  scheduleUnlock: 0 4 * * *
  schedulelock: 0 6 * * *

updateStrategy: OnDelete


tolerations:
  - key: node-role.kubernetes.io/master
    effect: NoSchedule

priorityClassName: ""

nodeSelector: {}

podAnnotations: {}
