# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}

{{- define "kong.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{- define "kong.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{- define "kong.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{- define "kong.metaLabels" -}}
app.kubernetes.io/name: {{ template "kong.name" . }}
helm.sh/chart: {{ template "kong.chart" . }}
app.kubernetes.io/instance: "{{ .Release.Name }}"
app.kubernetes.io/managed-by: "{{ .Release.Service }}"
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end -}}

{{- define "kong.selectorLabels" -}}
app.kubernetes.io/name: {{ template "kong.name" . }}
app.kubernetes.io/component: app
app.kubernetes.io/instance: "{{ .Release.Name }}"
{{- end -}}

{{- define "kong.postgresql.fullname" -}}
{{- $name := default "postgresql" .Values.postgresql.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{- define "kong.dblessConfig.fullname" -}}
{{- $name := default "kong-custom-dbless-config" .Values.dblessConfig.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create the name of the service account to use
*/}}
{{- define "kong.serviceAccountName" -}}
{{- if .Values.ingressController.serviceAccount.create -}}
    {{ default (include "kong.fullname" .) .Values.ingressController.serviceAccount.name }}
{{- else -}}
    {{ default "default" .Values.ingressController.serviceAccount.name }}
{{- end -}}
{{- end -}}

{{/*
Create the KONG_PROXY_LISTEN value string
*/}}
{{- define "kong.kongProxyListenValue" -}}

{{- if and .Values.proxy.http.enabled .Values.proxy.tls.enabled -}}
   0.0.0.0:{{ .Values.proxy.http.containerPort }},0.0.0.0:{{ .Values.proxy.tls.containerPort }} ssl
{{- else -}}
{{- if .Values.proxy.http.enabled -}}
   0.0.0.0:{{ .Values.proxy.http.containerPort }}
{{- end -}}
{{- if .Values.proxy.tls.enabled -}}
   0.0.0.0:{{ .Values.proxy.tls.containerPort }} ssl
{{- end -}}
{{- end -}}

{{- end }}

{{/*
Create the KONG_ADMIN_GUI_LISTEN value string
*/}}
{{- define "kong.kongManagerListenValue" -}}

{{- if and .Values.manager.http.enabled .Values.manager.tls.enabled -}}
   0.0.0.0:{{ .Values.manager.http.containerPort }},0.0.0.0:{{ .Values.manager.tls.containerPort }} ssl
{{- else -}}
{{- if .Values.manager.http.enabled -}}
   0.0.0.0:{{ .Values.manager.http.containerPort }}
{{- end -}}
{{- if .Values.manager.tls.enabled -}}
   0.0.0.0:{{ .Values.manager.tls.containerPort }} ssl
{{- end -}}
{{- end -}}

{{- end }}

{{/*
Create the KONG_PORTAL_GUI_LISTEN value string
*/}}
{{- define "kong.kongPortalListenValue" -}}

{{- if and .Values.portal.http.enabled .Values.portal.tls.enabled -}}
   0.0.0.0:{{ .Values.portal.http.containerPort }},0.0.0.0:{{ .Values.portal.tls.containerPort }} ssl
{{- else -}}
{{- if .Values.portal.http.enabled -}}
   0.0.0.0:{{ .Values.portal.http.containerPort }}
{{- end -}}
{{- if .Values.portal.tls.enabled -}}
   0.0.0.0:{{ .Values.portal.tls.containerPort }} ssl
{{- end -}}
{{- end -}}

{{- end }}

{{/*
Create the KONG_PORTAL_API_LISTEN value string
*/}}
{{- define "kong.kongPortalApiListenValue" -}}

{{- if and .Values.portalapi.http.enabled .Values.portalapi.tls.enabled -}}
   0.0.0.0:{{ .Values.portalapi.http.containerPort }},0.0.0.0:{{ .Values.portalapi.tls.containerPort }} ssl
{{- else -}}
{{- if .Values.portalapi.http.enabled -}}
   0.0.0.0:{{ .Values.portalapi.http.containerPort }}
{{- end -}}
{{- if .Values.portalapi.tls.enabled -}}
   0.0.0.0:{{ .Values.portalapi.tls.containerPort }} ssl
{{- end -}}
{{- end -}}

{{- end }}

{{/*
Create the ingress servicePort value string
*/}}

{{- define "kong.ingress.servicePort" -}}
{{- if .tls.enabled -}}
   {{ .tls.servicePort }}
{{- else -}}
   {{ .http.servicePort }}
{{- end -}}
{{- end -}}

{{/*
Generate an appropriate external URL from a Kong service's ingress configuration
Strips trailing slashes from the path. Manager at least does not handle these
intelligently and will append its own slash regardless, and the admin API cannot handle
the extra slash.
*/}}

{{- define "kong.ingress.serviceUrl" -}}
{{- if .tls -}}
    https://{{ .hostname }}{{ .path | trimSuffix "/" }}
{{- else -}}
    http://{{ .hostname }}{{ .path | trimSuffix "/" }}
{{- end -}}
{{- end -}}

{{/*
The name of the service used for the ingress controller's validation webhook
*/}}

{{- define "kong.service.validationWebhook" -}}
{{ include "kong.fullname" . }}-validation-webhook
{{- end -}}

{{- define "kong.env" -}}
{{- range $key, $val := .Values.env }}
- name: KONG_{{ $key | upper}}
{{- $valueType := printf "%T" $val -}}
{{ if eq $valueType "map[string]interface {}" }}
{{ toYaml $val | indent 2 -}}
{{- else }}
  value: {{ $val | quote -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{- define "kong.ingressController.env" -}}
{{- range $key, $val := .Values.ingressController.env }}
- name: CONTROLLER_{{ $key | upper}}
{{- $valueType := printf "%T" $val -}}
{{ if eq $valueType "map[string]interface {}" }}
{{ toYaml $val | indent 2 -}}
{{- else }}
  value: {{ $val | quote -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{- define "kong.volumes" -}}
- name: {{ template "kong.fullname" . }}-prefix-dir
  emptyDir: {}
- name: {{ template "kong.fullname" . }}-tmp
  emptyDir: {}
{{- range .Values.plugins.configMaps }}
- name: kong-plugin-{{ .pluginName }}
  configMap:
    name: {{ .name }}
{{- end }}
{{- range .Values.plugins.secrets }}
- name: kong-plugin-{{ .pluginName }}
  secret:
    secretName: {{ .name }}
{{- end }}
- name: custom-nginx-template-volume
  configMap:
    name: {{ template "kong.fullname" . }}-default-custom-server-blocks
{{- if (and (not .Values.ingressController.enabled) (eq .Values.env.database "off")) }}
- name: kong-custom-dbless-config-volume
  configMap:
    {{- if .Values.dblessConfig.configMap }}
    name: {{ .Values.dblessConfig.configMap }}
    {{- else }}
    name: {{ template "kong.dblessConfig.fullname" . }}
    {{- end }}
{{- end }}
{{- if .Values.ingressController.admissionWebhook.enabled }}
- name: webhook-cert
  secret:
    secretName: {{ template "kong.fullname" . }}-validation-webhook-keypair
{{- end }}
{{- range $secretVolume := .Values.secretVolumes }}
- name: {{ . }}
  secret:
    secretName: {{ . }}
{{- end }}
{{- end -}}

{{- define "kong.volumeMounts" -}}
- name: {{ template "kong.fullname" . }}-prefix-dir
  mountPath: /kong_prefix/
- name: {{ template "kong.fullname" . }}-tmp
  mountPath: /tmp
- name: custom-nginx-template-volume
  mountPath: /kong
{{- if (and (not .Values.ingressController.enabled) (eq .Values.env.database "off")) }}
- name: kong-custom-dbless-config-volume
  mountPath: /kong_dbless/
{{- end }}
{{- range .Values.secretVolumes }}
- name:  {{ . }}
  mountPath: /etc/secrets/{{ . }}
{{- end }}
{{- range .Values.plugins.configMaps }}
- name:  kong-plugin-{{ .pluginName }}
  mountPath: /opt/kong/plugins/{{ .pluginName }}
  readOnly: true
{{- end }}
{{- range .Values.plugins.secrets }}
- name:  kong-plugin-{{ .pluginName }}
  mountPath: /opt/kong/plugins/{{ .pluginName }}
  readOnly: true
{{- end }}
{{- end -}}

{{- define "kong.plugins" -}}
{{ $myList := list "bundled" }}
{{- range .Values.plugins.configMaps -}}
{{- $myList = append $myList .pluginName -}}
{{- end -}}
{{- range .Values.plugins.secrets -}}
  {{ $myList = append $myList .pluginName -}}
{{- end }}
{{- $myList | join "," -}}
{{- end -}}

{{- define "kong.wait-for-db" -}}
- name: wait-for-db
  image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
  imagePullPolicy: {{ .Values.image.pullPolicy }}
  env:
  {{- if .Values.enterprise.enabled }}
  {{- include "kong.license" . | nindent 2 }}
  {{- end }}
  {{- if .Values.postgresql.enabled }}
  - name: KONG_PG_HOST
    value: {{ template "kong.postgresql.fullname" . }}
  - name: KONG_PG_PORT
    value: "{{ .Values.postgresql.service.port }}"
  - name: KONG_PG_PASSWORD
    valueFrom:
      secretKeyRef:
        name: {{ template "kong.postgresql.fullname" . }}
        key: postgresql-password
  {{- end }}
  - name: KONG_LUA_PACKAGE_PATH
    value: "/opt/?.lua;;"
  - name: KONG_PLUGINS
    value: {{ template "kong.plugins" . }}
  {{- include "kong.env" .  | nindent 2 }}
  command: [ "/bin/sh", "-c", "until kong start; do echo 'waiting for db'; sleep 1; done; kong stop" ]
  volumeMounts:
  {{- include "kong.volumeMounts" . | nindent 4 }}
{{- end -}}

{{- define "kong.controller-container" -}}
- name: ingress-controller
  args:
  - /kong-ingress-controller
  # Service from were we extract the IP address/es to use in Ingress status
  - --publish-service={{ .Release.Namespace }}/{{ template "kong.fullname" . }}-proxy
  # Set the ingress class
  - --ingress-class={{ .Values.ingressController.ingressClass }}
  - --election-id=kong-ingress-controller-leader-{{ .Values.ingressController.ingressClass }}
  # the kong URL points to the kong admin api server
  {{- if .Values.admin.useTLS }}
  - --kong-url=https://localhost:{{ .Values.admin.containerPort }}
  - --admin-tls-skip-verify # TODO make this configurable
  {{- else }}
  - --kong-url=http://localhost:{{ .Values.admin.containerPort }}
  {{- end }}
  {{- if .Values.ingressController.admissionWebhook.enabled }}
  - --admission-webhook-listen=0.0.0.0:{{ .Values.ingressController.admissionWebhook.port }}
  {{- end }}
  env:
  - name: POD_NAME
    valueFrom:
      fieldRef:
        apiVersion: v1
        fieldPath: metadata.name
  - name: POD_NAMESPACE
    valueFrom:
      fieldRef:
        apiVersion: v1
        fieldPath: metadata.namespace
{{- include "kong.ingressController.env" .  | indent 2 }}
  image: "{{ .Values.ingressController.image.repository }}:{{ .Values.ingressController.image.tag }}"
  imagePullPolicy: {{ .Values.image.pullPolicy }}
  readinessProbe:
{{ toYaml .Values.ingressController.readinessProbe | indent 4 }}
  livenessProbe:
{{ toYaml .Values.ingressController.livenessProbe | indent 4 }}
  resources:
{{ toYaml .Values.ingressController.resources | indent 4 }}
{{- if .Values.ingressController.admissionWebhook.enabled }}
  volumeMounts:
  - name: webhook-cert
    mountPath: /admission-webhook
    readOnly: true
{{- end }}
{{- end -}}

{{/*
Retrieve Kong Enterprise license from a secret and make it available in env vars
*/}}
{{- define "kong.license" -}}
- name: KONG_LICENSE_DATA
  valueFrom:
    secretKeyRef:
      name: {{ .Values.enterprise.license_secret }}
      key: license
{{- end -}}

{{/*
Use the Pod security context defined in Values or set the UID by default
*/}}
{{- define "kong.podsecuritycontext" -}}
{{ .Values.securityContext | toYaml }}
{{- end -}}

{{/*
The environment values passed to Kong; this should come after all
the template that it itself is using form the above sections.
*/}}
{{- define "kong.final_env" -}}
- name: KONG_LUA_PACKAGE_PATH
  value: "/opt/?.lua;;"
{{- if not .Values.env.admin_listen }}
{{- if .Values.admin.useTLS }}
- name: KONG_ADMIN_LISTEN
  value: "0.0.0.0:{{ .Values.admin.containerPort }} ssl"
{{- else }}
- name: KONG_ADMIN_LISTEN
  value: 0.0.0.0:{{ .Values.admin.containerPort }}
{{- end }}
{{- end }}
{{- if .Values.admin.ingress.enabled }}
- name: KONG_ADMIN_API_URI
  value: {{ include "kong.ingress.serviceUrl" .Values.admin.ingress }}
{{- end }}
{{- if not .Values.env.proxy_listen }}
- name: KONG_PROXY_LISTEN
  value: {{ template "kong.kongProxyListenValue" . }}
{{- end }}
{{- if and (not .Values.env.admin_gui_listen) (.Values.enterprise.enabled) }}
- name: KONG_ADMIN_GUI_LISTEN
  value: {{ template "kong.kongManagerListenValue" . }}
{{- end }}
{{- if and (.Values.manager.ingress.enabled) (.Values.enterprise.enabled) }}
- name: KONG_ADMIN_GUI_URL
  value: {{ include "kong.ingress.serviceUrl" .Values.manager.ingress }}
{{- end }}
{{- if and (not .Values.env.portal_gui_listen) (.Values.enterprise.enabled) (.Values.enterprise.portal.enabled) }}
- name: KONG_PORTAL_GUI_LISTEN
  value: {{ template "kong.kongPortalListenValue" . }}
{{- end }}
{{- if and (.Values.portal.ingress.enabled) (.Values.enterprise.enabled) (.Values.enterprise.portal.enabled) }}
- name: KONG_PORTAL_GUI_HOST
  value: {{ .Values.portal.ingress.hostname }}
{{- if .Values.portal.ingress.tls }}
- name: KONG_PORTAL_GUI_PROTOCOL
  value: https
{{- else }}
- name: KONG_PORTAL_GUI_PROTOCOL
  value: http
{{- end }}
{{- end }}
{{- if and (not .Values.env.portal_api_listen) (.Values.enterprise.enabled) (.Values.enterprise.portal.enabled) }}
- name: KONG_PORTAL_API_LISTEN
  value: {{ template "kong.kongPortalApiListenValue" . }}
{{- end }}
{{- if and (.Values.portalapi.ingress.enabled) (.Values.enterprise.enabled) (.Values.enterprise.portal.enabled) }}
- name: KONG_PORTAL_API_URL
  value: {{ include "kong.ingress.serviceUrl" .Values.portalapi.ingress }}
{{- end }}
- name: KONG_NGINX_DAEMON
  value: "off"
{{- if .Values.enterprise.enabled }}
{{- if not .Values.enterprise.vitals.enabled }}
- name: KONG_VITALS
  value: "off"
{{- end }}
{{- if .Values.enterprise.portal.enabled }}
- name: KONG_PORTAL
  value: "on"
{{- if .Values.enterprise.portal.portal_auth }}
- name: KONG_PORTAL_AUTH
  value: {{ .Values.enterprise.portal.portal_auth }}
- name: KONG_PORTAL_SESSION_CONF
  valueFrom:
    secretKeyRef:
      name: {{ .Values.enterprise.portal.session_conf_secret }}
      key: portal_session_conf
{{- end }}
{{- end }}
{{- if .Values.enterprise.rbac.enabled }}
- name: KONG_ENFORCE_RBAC
  value: "on"
- name: KONG_ADMIN_GUI_AUTH
  value: {{ .Values.enterprise.rbac.admin_gui_auth | default "basic-auth" }}
{{- if not (eq .Values.enterprise.rbac.admin_gui_auth "basic-auth") }}
- name: KONG_ADMIN_GUI_AUTH_CONF
  valueFrom:
    secretKeyRef:
      name: {{ .Values.enterprise.rbac.admin_gui_auth_conf_secret }}
      key: admin_gui_auth_conf
{{- end }}
- name: KONG_ADMIN_GUI_SESSION_CONF
  valueFrom:
    secretKeyRef:
      name: {{ .Values.enterprise.rbac.session_conf_secret }}
      key: admin_gui_session_conf
{{- end }}
{{- if .Values.enterprise.smtp.enabled }}
- name: KONG_PORTAL_EMAILS_FROM
  value: {{ .Values.enterprise.smtp.portal_emails_from }}
- name: KONG_PORTAL_EMAILS_REPLY_TO
  value: {{ .Values.enterprise.smtp.portal_emails_reply_to }}
- name: KONG_ADMIN_EMAILS_FROM
  value: {{ .Values.enterprise.smtp.admin_emails_from }}
- name: KONG_ADMIN_EMAILS_REPLY_TO
  value: {{ .Values.enterprise.smtp.admin_emails_reply_to }}
- name: KONG_SMTP_HOST
  value: {{ .Values.enterprise.smtp.smtp_host }}
- name: KONG_SMTP_PORT
  value: {{ .Values.enterprise.smtp.smtp_port | quote }}
- name: KONG_SMTP_STARTTLS
  value: {{ .Values.enterprise.smtp.smtp_starttls | quote }}
{{- if .Values.enterprise.smtp.auth.smtp_username }}
- name: KONG_SMTP_USERNAME
  value: {{ .Values.enterprise.smtp.auth.smtp_username }}
- name: KONG_SMTP_PASSWORD
  valueFrom:
    secretKeyRef:
      name: {{ .Values.enterprise.smtp.auth.smtp_password_secret }}
      key: smtp_password
{{- end }}
{{- else }}
- name: KONG_SMTP_MOCK
  value: "on"
{{- end }}
{{ include "kong.license" . }}
{{- end }}
- name: KONG_NGINX_HTTP_INCLUDE
  value: /kong/servers.conf
{{- if .Values.postgresql.enabled }}
- name: KONG_PG_HOST
  value: {{ template "kong.postgresql.fullname" . }}
- name: KONG_PG_PORT
  value: "{{ .Values.postgresql.service.port }}"
- name: KONG_PG_PASSWORD
  valueFrom:
    secretKeyRef:
      name: {{ template "kong.postgresql.fullname" . }}
      key: postgresql-password
{{- end }}
{{- if (and (not .Values.ingressController.enabled) (eq .Values.env.database "off")) }}
- name: KONG_DECLARATIVE_CONFIG
  value: "/kong_dbless/kong.yml"
{{- end }}
- name: KONG_PLUGINS
  value: {{ template "kong.plugins" . }}
{{- include "kong.env" . }}
{{- end -}}

{{- define "kong.wait-for-postgres" -}}
- name: wait-for-postgres
  image: "{{ .Values.waitImage.repository }}:{{ .Values.waitImage.tag }}"
  imagePullPolicy: {{ .Values.waitImage.pullPolicy }}
  env:
  {{- include "kong.final_env" . | nindent 2 }}
  command: [ "/bin/sh", "-c", "until nc -zv $KONG_PG_HOST $KONG_PG_PORT -w1; do echo 'waiting for db'; sleep 1; done" ]
{{- end -}}
 # admission-webhook.yaml
{{- if .Values.ingressController.admissionWebhook.enabled }}
{{- $cn := printf "%s.%s.svc" ( include "kong.service.validationWebhook" . ) .Release.Namespace }}
{{- $ca := genCA "kong-admission-ca" 3650 -}}
{{- $cert := genSignedCert $cn nil nil 3650 $ca -}}
kind: ValidatingWebhookConfiguration
{{- if .Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1" }}
apiVersion: admissionregistration.k8s.io/v1
{{- else }}
apiVersion: admissionregistration.k8s.io/v1beta1
{{- end }}
metadata:
  name: {{ template "kong.fullname" . }}-validations
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
webhooks:
- name: validations.kong.konghq.com
  failurePolicy: {{ .Values.ingressController.admissionWebhook.failurePolicy }}
  sideEffects: None
  admissionReviewVersions: ["v1beta1"]
  rules:
  - apiGroups:
    - configuration.konghq.com
    apiVersions:
    - '*'
    operations:
    - CREATE
    - UPDATE
    resources:
    - kongconsumers
    - kongplugins
  clientConfig:
    caBundle: {{ b64enc $ca.Cert }}
    service:
      name: {{ template "kong.service.validationWebhook" . }}
      namespace: {{ .Release.Namespace }}
---
apiVersion: v1
kind: Service
metadata:
  name: {{ template "kong.service.validationWebhook" . }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
spec:
  ports:
  - name: webhook
    port: 443
    protocol: TCP
    targetPort: webhook
  selector:
    {{- include "kong.metaLabels" . | nindent 4 }}
    app.kubernetes.io/component: app
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "kong.fullname" . }}-validation-webhook-keypair
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
type: kubernetes.io/tls
data:
  tls.crt: {{ b64enc $cert.Cert }}
  tls.key: {{ b64enc $cert.Key }}
{{ end }}
 # config-custom-server-blocks.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "kong.fullname" . }}-default-custom-server-blocks
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
data:
  servers.conf: |
    # Prometheus metrics and health-checking server
    server {
        server_name kong_prometheus_exporter;
        listen 0.0.0.0:9542; # can be any other port as well
        access_log off;
        location /status {
            default_type text/plain;
            return 200;
        }
        location /metrics {
            default_type text/plain;
            content_by_lua_block {
                 local prometheus = require "kong.plugins.prometheus.exporter"
                 prometheus:collect()
            }
        }
        location /nginx_status {
            internal;
            access_log off;
            stub_status;
        }
    }
 # config-dbless.yaml
{{- if (and (not .Values.ingressController.enabled) (eq .Values.env.database "off")) }}
{{- if not .Values.dblessConfig.configMap }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "kong.dblessConfig.fullname" . }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
data:
  kong.yml: |
{{ .Values.dblessConfig.config | toYaml | indent 4 }}
{{- end }}
{{- end }}
 # controller-rbac-resources.yaml
{{- if and .Values.ingressController.rbac.create .Values.ingressController.enabled -}}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name:  {{ template "kong.fullname" . }}
  namespace: {{ .Release.namespace }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - pods
      - secrets
      - namespaces
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - configmaps
    resourceNames:
      # Defaults to "<election-id>-<ingress-class>"
      # Here: "<kong-ingress-controller-leader-nginx>-<nginx>"
      # This has to be adapted if you change either parameter
      # when launching the nginx-ingress-controller.
      - "kong-ingress-controller-leader-{{ .Values.ingressController.ingressClass }}-{{ .Values.ingressController.ingressClass }}"
    verbs:
      - get
      - update
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - create
  - apiGroups:
      - ""
    resources:
      - endpoints
    verbs:
      - get
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name:  {{ template "kong.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ template "kong.fullname" . }}
subjects:
  - kind: ServiceAccount
    name: {{ template "kong.serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
  name:  {{ template "kong.fullname" . }}
rules:
  - apiGroups:
      - ""
    resources:
      - endpoints
      - nodes
      - pods
      - secrets
    verbs:
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "extensions"
      - "networking.k8s.io"
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
        - events
    verbs:
        - create
        - patch
  - apiGroups:
      - "extensions"
      - "networking.k8s.io"
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - "configuration.konghq.com"
    resources:
      - kongplugins
      - kongcredentials
      - kongconsumers
      - kongingresses
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name:  {{ template "kong.fullname" . }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name:  {{ template "kong.fullname" . }}
subjects:
  - kind: ServiceAccount
    name: {{ template "kong.serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
{{- end -}}
 # controller-service-account.yaml
{{- if or .Values.podSecurityPolicy.enabled (and .Values.ingressController.enabled .Values.ingressController.serviceAccount.create) -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "kong.serviceAccountName" . }}
  namespace: {{ .Release.namespace }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
{{- end -}}
 # custom-resource-definitions.yaml
{{- if and .Values.ingressController.enabled .Values.ingressController.installCRDs -}}
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: kongconsumers.configuration.konghq.com
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
spec:
  group: configuration.konghq.com
  version: v1
  scope: Namespaced
  names:
    kind: KongConsumer
    plural: kongconsumers
    shortNames:
    - kc
  additionalPrinterColumns:
  - name: Username
    type: string
    description: Username of a Kong Consumer
    JSONPath: .username
  - name: Age
    type: date
    description: Age
    JSONPath: .metadata.creationTimestamp
  validation:
    openAPIV3Schema:
      properties:
        username:
          type: string
        custom_id:
          type: string
        credentials:
          type: array
          items:
            type: string
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: kongcredentials.configuration.konghq.com
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
spec:
  group: configuration.konghq.com
  version: v1
  scope: Namespaced
  names:
    kind: KongCredential
    plural: kongcredentials
  additionalPrinterColumns:
  - name: Credential-type
    type: string
    description: Type of credential
    JSONPath: .type
  - name: Age
    type: date
    description: Age
    JSONPath: .metadata.creationTimestamp
  - name: Consumer-Ref
    type: string
    description: Owner of the credential
    JSONPath: .consumerRef
  validation:
    openAPIV3Schema:
      required:
      - consumerRef
      - type
      properties:
        consumerRef:
          type: string
        type:
          type: string
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: kongplugins.configuration.konghq.com
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
spec:
  group: configuration.konghq.com
  version: v1
  scope: Namespaced
  names:
    kind: KongPlugin
    plural: kongplugins
    shortNames:
    - kp
  additionalPrinterColumns:
  - name: Plugin-Type
    type: string
    description: Name of the plugin
    JSONPath: .plugin
  - name: Age
    type: date
    description: Age
    JSONPath: .metadata.creationTimestamp
  - name: Disabled
    type: boolean
    description: Indicates if the plugin is disabled
    JSONPath: .disabled
    priority: 1
  - name: Config
    type: string
    description: Configuration of the plugin
    JSONPath: .config
    priority: 1
  validation:
    openAPIV3Schema:
      required:
      - plugin
      properties:
        plugin:
          type: string
        disabled:
          type: boolean
        config:
          type: object
        run_on:
          type: string
          enum:
          - first
          - second
          - all
        protocols:
          type: array
          items:
            type: string
            enum:
            - http
            - https
            - tcp
            - tls
            - grpc
            - grpcs
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: kongingresses.configuration.konghq.com
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
spec:
  group: configuration.konghq.com
  version: v1
  scope: Namespaced
  names:
    kind: KongIngress
    plural: kongingresses
    shortNames:
    - ki
  validation:
    openAPIV3Schema:
      properties:
        route:
          properties:
            methods:
              type: array
              items:
                type: string
            headers:
              type: object
              additionalProperties:
                type: array
                items:
                  type: string
            regex_priority:
              type: integer
            strip_path:
              type: boolean
            preserve_host:
              type: boolean
            protocols:
              type: array
              items:
                type: string
                enum:
                - http
                - https
                - grpc
                - grpcs
            https_redirect_status_code:
              type: integer
        proxy:
          type: object
          properties:
            protocol:
              type: string
              enum:
              - http
              - https
              - grpc
              - grpcs
            path:
              type: string
              pattern: ^/.*$
            retries:
              type: integer
              minimum: 0
            connect_timeout:
              type: integer
              minimum: 0
            read_timeout:
              type: integer
              minimum: 0
            write_timeout:
              type: integer
              minimum: 0
        upstream:
          type: object
          properties:
            algorithm:
              type: string
              enum:
              - "round-robin"
              - "consistent-hashing"
              - "least-connections"
            host_header:
              type: string
            hash_on:
              type: string
            hash_on_cookie:
              type: string
            hash_on_cookie_path:
              type: string
            hash_on_header:
              type: string
            hash_fallback_header:
              type: string
            hash_fallback:
              type: string
            slots:
              type: integer
              minimum: 10
            healthchecks:
              type: object
              properties:
                active:
                  type: object
                  properties:
                    concurrency:
                      type: integer
                      minimum: 1
                    timeout:
                      type: integer
                      minimum: 0
                    http_path:
                      type: string
                      pattern: ^/.*$
                    healthy: &healthy
                      type: object
                      properties:
                        http_statuses:
                          type: array
                          items:
                            type: integer
                        interval:
                          type: integer
                          minimum: 0
                        successes:
                          type: integer
                          minimum: 0
                    unhealthy: &unhealthy
                      type: object
                      properties:
                        http_failures:
                          type: integer
                          minimum: 0
                        http_statuses:
                          type: array
                          items:
                            type: integer
                        interval:
                          type: integer
                          minimum: 0
                        tcp_failures:
                          type: integer
                          minimum: 0
                        timeout:
                          type: integer
                          minimum: 0
                passive:
                  type: object
                  properties:
                    healthy: *healthy
                    unhealthy: *unhealthy
{{- end -}}
 # deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "kong.fullname" . }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
    app.kubernetes.io/component: app
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "kong.selectorLabels" . | nindent 6 }}
  {{- if .Values.updateStrategy }}
  strategy:
{{ toYaml .Values.updateStrategy | indent 4 }}
  {{- end }}

  template:
    metadata:
      annotations:
        {{- if .Values.ingressController.admissionWebhook.enabled }}
        checksum/admission-webhook.yaml: {{ include (print $.Template.BasePath "/admission-webhook.yaml") . | sha256sum }}
        {{- end }}
        {{- if (and (not .Values.ingressController.enabled) (eq .Values.env.database "off" )) }}
        {{- if .Values.dblessConfig.config }}
        checksum/dbless.config: {{ toYaml .Values.dblessConfig.config | sha256sum }}
        {{- end }}
        {{- end }}
        {{- if .Values.podAnnotations }}
{{ toYaml .Values.podAnnotations | indent 8 }}
        {{- end }}
      labels:
        {{- include "kong.metaLabels" . | nindent 8 }}
        app.kubernetes.io/component: app
    spec:
      {{- if or .Values.ingressController.enabled .Values.podSecurityPolicy.enabled }}
      serviceAccountName: {{ template "kong.serviceAccountName" . }}
      {{ end }}
      {{- if .Values.image.pullSecrets }}
      imagePullSecrets:
      {{- range .Values.image.pullSecrets }}
        - name: {{ . }}
      {{- end }}
      {{- end }}
      {{- if not (eq .Values.env.database "off") }}
      initContainers:
      {{- include "kong.wait-for-db" . | nindent 6 }}
      {{ end }}
      containers:
      {{- if .Values.ingressController.enabled }}
      {{- include "kong.controller-container" . | nindent 6 }}
      {{ end }}
      - name: "proxy"
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        env:
        {{- include "kong.final_env" . | nindent 8 }}
        lifecycle:
          preStop:
            exec:
              command: [ "/bin/sh", "-c", "kong quit" ]
        ports:
        - name: admin
          containerPort: {{ .Values.admin.containerPort }}
          {{- if .Values.admin.hostPort }}
          hostPort: {{ .Values.admin.hostPort }}
          {{- end}}
          protocol: TCP
        {{- if .Values.proxy.http.enabled }}
        - name: proxy
          containerPort: {{ .Values.proxy.http.containerPort }}
          {{- if .Values.proxy.http.hostPort }}
          hostPort: {{ .Values.proxy.http.hostPort }}
          {{- end}}
          protocol: TCP
        {{- end }}
        {{- if .Values.proxy.tls.enabled }}
        - name: proxy-tls
          containerPort: {{ .Values.proxy.tls.containerPort }}
          {{- if .Values.proxy.tls.hostPort }}
          hostPort: {{ .Values.proxy.tls.hostPort }}
          {{- end}}
          protocol: TCP
        {{- end }}
        - name: metrics
          containerPort: 9542
          protocol: TCP
        {{- if .Values.ingressController.admissionWebhook.enabled }}
        - name: webhook
          containerPort: {{ .Values.ingressController.admissionWebhook.port }}
          protocol: TCP
        {{- end }}
        {{- if .Values.enterprise.enabled }}
        {{- if .Values.manager.http.enabled }}
        - name: manager
          containerPort: {{ .Values.manager.http.containerPort }}
          {{- if .Values.manager.http.hostPort }}
          hostPort: {{ .Values.manager.http.hostPort }}
          {{- end}}
          protocol: TCP
        {{- end }}
        {{- if .Values.manager.tls.enabled }}
        - name: manager-tls
          containerPort: {{ .Values.manager.tls.containerPort }}
          {{- if .Values.manager.tls.hostPort }}
          hostPort: {{ .Values.manager.tls.hostPort }}
          {{- end}}
          protocol: TCP
        {{- end }}
        {{- if .Values.portal.http.enabled }}
        - name: portal
          containerPort: {{ .Values.portal.http.containerPort }}
          {{- if .Values.portal.http.hostPort }}
          hostPort: {{ .Values.portal.http.hostPort }}
          {{- end}}
          protocol: TCP
        {{- end }}
        {{- if .Values.portal.tls.enabled }}
        - name: portal-tls
          containerPort: {{ .Values.portal.tls.containerPort }}
          {{- if .Values.portal.tls.hostPort }}
          hostPort: {{ .Values.portal.tls.hostPort }}
          {{- end}}
          protocol: TCP
        {{- end }}
        {{- if .Values.portalapi.http.enabled }}
        - name: portalapi
          containerPort: {{ .Values.portalapi.http.containerPort }}
          {{- if .Values.portalapi.http.hostPort }}
          hostPort: {{ .Values.portalapi.http.hostPort }}
          {{- end}}
          protocol: TCP
        {{- end }}
        {{- if .Values.portalapi.tls.enabled }}
        - name: portalapi-tls
          containerPort: {{ .Values.portalapi.tls.containerPort }}
          {{- if .Values.portalapi.tls.hostPort }}
          hostPort: {{ .Values.portalapi.tls.hostPort }}
          {{- end}}
          protocol: TCP
        {{- end }}
        {{- end }}
        volumeMounts:
        {{- include "kong.volumeMounts" . | nindent 10 }}
        readinessProbe:
{{ toYaml .Values.readinessProbe | indent 10 }}
        livenessProbe:
{{ toYaml .Values.livenessProbe | indent 10 }}
        resources:
{{ toYaml .Values.resources | indent 10 }}
    {{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
    {{- end }}
      securityContext:
      {{- include "kong.podsecuritycontext" . | nindent 8 }}
    {{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
    {{- end }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 }}
      volumes:
      {{- include "kong.volumes" . | nindent 8 -}}
 # ingress-admin.yaml
{{- if .Values.admin.ingress.enabled -}}
{{- $serviceName := include "kong.fullname" . -}}
{{- $servicePort := .Values.admin.servicePort -}}
{{- $path := .Values.admin.ingress.path -}}
{{- $tls := .Values.admin.ingress.tls -}}
{{- $hostname := .Values.admin.ingress.hostname -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ template "kong.fullname" . }}-admin
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
  annotations:
    {{- range $key, $value := .Values.admin.ingress.annotations }}
      {{ $key }}: {{ $value | quote }}
    {{- end }}
spec:
  rules:
  - host: {{ $hostname }}
    http:
      paths:
        - path: {{ $path }}
          backend:
            serviceName: {{ $serviceName }}-admin
            servicePort: {{ $servicePort }}
  {{- if $tls }}
  tls:
  - hosts:
    - {{ $hostname }}
    secretName: {{ $tls }}
  {{- end -}}
{{- end -}}
 # ingress-manager.yaml
{{- if .Values.enterprise.enabled }}
{{- if .Values.manager.ingress.enabled -}}
{{- $serviceName := include "kong.fullname" . -}}
{{- $servicePort := include "kong.ingress.servicePort" .Values.manager -}}
{{- $path := .Values.manager.ingress.path -}}
{{- $tls := .Values.manager.ingress.tls -}}
{{- $hostname := .Values.manager.ingress.hostname -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ template "kong.fullname" . }}-manager
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
  annotations:
    {{- range $key, $value := .Values.manager.ingress.annotations }}
      {{ $key }}: {{ $value | quote }}
    {{- end }}
spec:
  rules:
  - host: {{ $hostname }}
    http:
      paths:
        - path: {{ $path }}
          backend:
            serviceName: {{ $serviceName }}-manager
            servicePort: {{ $servicePort }}
  {{- if $tls }}
  tls:
  - hosts:
    - {{ $hostname }}
    secretName: {{ $tls }}
  {{- end -}}
{{- end -}}
{{- end -}}
 # ingress-portal-api.yaml
{{- if .Values.enterprise.enabled }}
{{- if .Values.portalapi.ingress.enabled -}}
{{- $serviceName := include "kong.fullname" . -}}
{{- $servicePort := include "kong.ingress.servicePort" .Values.portalapi -}}
{{- $path := .Values.portalapi.ingress.path -}}
{{- $tls := .Values.portalapi.ingress.tls -}}
{{- $hostname := .Values.portalapi.ingress.hostname -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ template "kong.fullname" . }}-portalapi
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
  annotations:
    {{- range $key, $value := .Values.portalapi.ingress.annotations }}
      {{ $key }}: {{ $value | quote }}
    {{- end }}
spec:
  rules:
  - host: {{ $hostname }}
    http:
      paths:
        - path: {{ $path }}
          backend:
            serviceName: {{ $serviceName }}-portalapi
            servicePort: {{ $servicePort }}
  {{- if $tls }}
  tls:
  - hosts:
    - {{ $hostname }}
    secretName: {{ $tls }}
  {{- end -}}
{{- end -}}
{{- end -}}
 # ingress-portal.yaml
{{- if .Values.enterprise.enabled }}
{{- if .Values.portal.ingress.enabled -}}
{{- $serviceName := include "kong.fullname" . -}}
{{- $servicePort := include "kong.ingress.servicePort" .Values.portal -}}
{{- $path := .Values.portal.ingress.path -}}
{{- $tls := .Values.portal.ingress.tls -}}
{{- $hostname := .Values.portal.ingress.hostname -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ template "kong.fullname" . }}-portal
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
  annotations:
    {{- range $key, $value := .Values.portal.ingress.annotations }}
      {{ $key }}: {{ $value | quote }}
    {{- end }}
spec:
  rules:
  - host: {{ $hostname }}
    http:
      paths:
        - path: {{ $path }}
          backend:
            serviceName: {{ $serviceName }}-portal
            servicePort: {{ $servicePort }}
  {{- if $tls }}
  tls:
  - hosts:
    - {{ $hostname }}
    secretName: {{ $tls }}
  {{- end -}}
{{- end -}}
{{- end -}}
 # ingress-proxy.yaml
{{- if .Values.proxy.ingress.enabled -}}
{{- $serviceName := include "kong.fullname" . -}}
{{- $servicePort := include "kong.ingress.servicePort" .Values.proxy -}}
{{- $path := .Values.proxy.ingress.path -}}
{{- $hosts_count := len .Values.proxy.ingress.hosts -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ template "kong.fullname" . }}-proxy
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
  annotations:
    {{- range $key, $value := .Values.proxy.ingress.annotations }}
      {{ $key }}: {{ $value | quote }}
    {{- end }}
spec:
  rules:
    {{- if eq $hosts_count 0 }}
    - http:
        paths:
          - path: {{ $path }}
            backend:
              serviceName: {{ $serviceName }}-proxy
              servicePort: {{ $servicePort }}
    {{ else -}}
    {{- range $host := .Values.proxy.ingress.hosts }}
    - host: {{ $host | quote }}
      http:
        paths:
          - path: {{ $path }}
            backend:
              serviceName: {{ $serviceName }}-proxy
              servicePort: {{ $servicePort }}
    {{- end -}}
    {{- end -}}
  {{- if .Values.proxy.ingress.tls }}
  tls:
{{ toYaml .Values.proxy.ingress.tls | indent 4 }}
  {{- end -}}
{{- end -}}
 # migrations-post-upgrade.yaml
{{- if (and (.Values.runMigrations) (not (eq .Values.env.database "off"))) }}
# Why is this Job duplicated and not using only helm hooks?
# See: https://github.com/helm/charts/pull/7362
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "kong.fullname" . }}-post-upgrade-migrations
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
    app.kubernetes.io/component: post-upgrade-migrations
  annotations:
    helm.sh/hook: "post-upgrade"
    helm.sh/hook-delete-policy: "before-hook-creation"
spec:
  template:
    metadata:
      name: {{ template "kong.name" . }}-post-upgrade-migrations
      labels:
        {{- include "kong.metaLabels" . | nindent 8 }}
        app.kubernetes.io/component: post-upgrade-migrations
    spec:
      {{- if .Values.podSecurityPolicy.enabled }}
      serviceAccountName: {{ template "kong.serviceAccountName" . }}
      {{- end }}
      {{- if .Values.image.pullSecrets }}
      imagePullSecrets:
      {{- range .Values.image.pullSecrets }}
        - name: {{ . }}
      {{- end }}
      {{- end }}
      initContainers:
      {{- if (eq .Values.env.database "postgres") }}
      {{- include "kong.wait-for-postgres" . | nindent 6 }}
      {{- end }}
      containers:
      - name: {{ template "kong.name" . }}-post-upgrade-migrations
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        env:
        {{- include "kong.final_env" . | nindent 8 }}
        command: [ "/bin/sh", "-c", "kong migrations finish" ]
        volumeMounts:
        {{- include "kong.volumeMounts" . | nindent 8 }}
      securityContext:
      {{- include "kong.podsecuritycontext" . | nindent 8 }}
      restartPolicy: OnFailure
      volumes:
      {{- include "kong.volumes" . | nindent 6 -}}
{{- end }}
 # migrations-pre-upgrade.yaml
{{- if (and (.Values.runMigrations) (not (eq .Values.env.database "off"))) }}
# Why is this Job duplicated and not using only helm hooks?
# See: https://github.com/helm/charts/pull/7362
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "kong.fullname" . }}-pre-upgrade-migrations
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
    app.kubernetes.io/component: pre-upgrade-migrations
  annotations:
    helm.sh/hook: "pre-upgrade"
    helm.sh/hook-delete-policy: "before-hook-creation"
spec:
  template:
    metadata:
      name: {{ template "kong.name" . }}-pre-upgrade-migrations
      labels:
        {{- include "kong.metaLabels" . | nindent 8 }}
        app.kubernetes.io/component: pre-upgrade-migrations
    spec:
      {{- if .Values.podSecurityPolicy.enabled }}
      serviceAccountName: {{ template "kong.serviceAccountName" . }}
      {{- end }}
      {{- if .Values.image.pullSecrets }}
      imagePullSecrets:
      {{- range .Values.image.pullSecrets }}
        - name: {{ . }}
      {{- end }}
      {{- end }}
      initContainers:
      {{- if (eq .Values.env.database "postgres") }}
      {{- include "kong.wait-for-postgres" . | nindent 6 }}
      {{- end }}
      containers:
      - name: {{ template "kong.name" . }}-upgrade-migrations
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        env:
        {{- include "kong.final_env" . | nindent 8 }}
        command: [ "/bin/sh", "-c", "kong migrations up" ]
        volumeMounts:
        {{- include "kong.volumeMounts" . | nindent 8 }}
      securityContext:
      {{- include "kong.podsecuritycontext" . | nindent 8 }}
      restartPolicy: OnFailure
      volumes:
      {{- include "kong.volumes" . | nindent 6 -}}
{{- end }}

{{ if or .Values.podSecurityPolicy.enabled (and .Values.ingressController.enabled .Values.ingressController.serviceAccount.create) -}}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "kong.serviceAccountName" . }}
  namespace: {{ .Release.namespace }}
  annotations:
    "helm.sh/hook": pre-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
{{- end -}}
 # migrations.yaml
{{- if (and (.Values.runMigrations) (not (eq .Values.env.database "off"))) }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "kong.fullname" . }}-init-migrations
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
    app.kubernetes.io/component: init-migrations
spec:
  template:
    metadata:
      name: {{ template "kong.name" . }}-init-migrations
      labels:
        {{- include "kong.metaLabels" . | nindent 8 }}
        app.kubernetes.io/component: init-migrations
    spec:
      {{- if .Values.podSecurityPolicy.enabled }}
      serviceAccountName: {{ template "kong.serviceAccountName" . }}
      {{- end }}
      {{- if .Values.image.pullSecrets }}
      imagePullSecrets:
      {{- range .Values.image.pullSecrets }}
        - name: {{ . }}
      {{- end }}
      {{- end }}
      initContainers:
      {{- if (eq .Values.env.database "postgres") }}
      {{- include "kong.wait-for-postgres" . | nindent 6 }}
      {{- end }}
      containers:
      - name: {{ template "kong.name" . }}-migrations
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        env:
        {{- include "kong.final_env" . | nindent 8 }}
        command: [ "/bin/sh", "-c", "kong migrations bootstrap" ]
        volumeMounts:
        {{- include "kong.volumeMounts" . | nindent 8 }}
      securityContext:
      {{- include "kong.podsecuritycontext" . | nindent 8 }}
      restartPolicy: OnFailure
      volumes:
      {{- include "kong.volumes" . | nindent 6 -}}
{{- end }}
 # pdb.yaml
{{- if .Values.podDisruptionBudget.enabled }}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: {{ template "kong.fullname" . }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
spec:
  {{- if .Values.podDisruptionBudget.minAvailable }}
  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
  {{- end  }}
  {{- if .Values.podDisruptionBudget.maxUnavailable }}
  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
  {{- end  }}
  selector:
    matchLabels:
      {{- include "kong.metaLabels" . | nindent 6 }}
{{- end }}
 # psp.yaml
{{- if .Values.podSecurityPolicy.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: {{ template "kong.serviceAccountName" . }}-psp
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
spec:
  privileged: false
  fsGroup:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  runAsGroup:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
    - 'configMap'
    - 'secret'
    - 'emptyDir'
  allowPrivilegeEscalation: false
  hostNetwork: false
  hostIPC: false
  hostPID: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "kong.serviceAccountName" . }}-psp
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
rules:
  - apiGroups:
      - extensions
    resources:
      - podsecuritypolicies
    verbs:
      - use
    resourceNames:
      - {{ template "kong.serviceAccountName" . }}-psp
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ template "kong.serviceAccountName" . }}-psp
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
subjects:
  - kind: ServiceAccount
    name: {{ template "kong.serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: {{ template "kong.serviceAccountName" . }}-psp
  apiGroup: rbac.authorization.k8s.io
{{- end }}
 # service-kong-admin.yaml
{{- if .Values.admin.enabled -}}
apiVersion: v1
kind: Service
metadata:
  name: {{ template "kong.fullname" . }}-admin
  annotations:
    {{- range $key, $value := .Values.admin.annotations }}
      {{ $key }}: {{ $value | quote }}
    {{- end }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
spec:
  type: {{ .Values.admin.type }}
  {{- if eq .Values.admin.type "LoadBalancer" }}
  {{- if .Values.admin.loadBalancerIP }}
  loadBalancerIP: {{ .Values.admin.loadBalancerIP }}
  {{- end }}
  {{- if .Values.admin.loadBalancerSourceRanges }}
  loadBalancerSourceRanges:
  {{- range $cidr := .Values.admin.loadBalancerSourceRanges }}
  - {{ $cidr }}
  {{- end }}
  {{- end }}
  {{- end }}
  ports:
  - name: kong-admin
    port: {{ .Values.admin.servicePort }}
    targetPort: {{ .Values.admin.containerPort }}
  {{- if (and (eq .Values.admin.type "NodePort") (not (empty .Values.admin.nodePort))) }}
    nodePort: {{ .Values.admin.nodePort }}
  {{- end }}
    protocol: TCP
  selector:
    {{- include "kong.selectorLabels" . | nindent 4 }}
{{- end -}}
 # service-kong-manager.yaml
{{- if .Values.enterprise.enabled }}
apiVersion: v1
kind: Service
metadata:
  name: {{ template "kong.fullname" . }}-manager
  annotations:
    {{- range $key, $value := .Values.manager.annotations }}
      {{ $key }}: {{ $value | quote }}
    {{- end }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
spec:
  type: {{ .Values.manager.type }}
  {{- if eq .Values.manager.type "LoadBalancer" }}
  {{- if .Values.manager.loadBalancerIP }}
  loadBalancerIP: {{ .Values.manager.loadBalancerIP }}
  {{- end }}
  {{- if .Values.manager.loadBalancerSourceRanges }}
  loadBalancerSourceRanges:
  {{- range $cidr := .Values.manager.loadBalancerSourceRanges }}
  - {{ $cidr }}
  {{- end }}
  {{- end }}
  {{- end }}
  externalIPs:
  {{- range $ip := .Values.manager.externalIPs }}
  - {{ $ip }}
  {{- end }}
  ports:
  {{- if .Values.manager.http.enabled }}
  - name: kong-manager
    port: {{ .Values.manager.http.servicePort }}
    targetPort: {{ .Values.manager.http.containerPort }}
  {{- if (and (eq .Values.manager.type "NodePort") (not (empty .Values.manager.http.nodePort))) }}
    nodePort: {{ .Values.manager.http.nodePort }}
  {{- end }}
    protocol: TCP
  {{- end }}
  {{- if or .Values.manager.tls.enabled }}
  - name: kong-manager-tls
    port: {{ .Values.manager.tls.servicePort }}
    targetPort: {{ .Values.manager.tls.containerPort }}
  {{- if (and (eq .Values.manager.type "NodePort") (not (empty .Values.manager.tls.nodePort))) }}
    nodePort: {{ .Values.manager.tls.nodePort }}
  {{- end }}
    protocol: TCP
  {{- end }}
  selector:
    {{- include "kong.selectorLabels" . | nindent 4 }}
{{- end -}}
 # service-kong-portal-api.yaml
{{- if .Values.enterprise.enabled }}
apiVersion: v1
kind: Service
metadata:
  name: {{ template "kong.fullname" . }}-portalapi
  annotations:
    {{- range $key, $value := .Values.portalapi.annotations }}
      {{ $key }}: {{ $value | quote }}
    {{- end }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
spec:
  type: {{ .Values.portalapi.type }}
  {{- if eq .Values.portalapi.type "LoadBalancer" }}
  {{- if .Values.portalapi.loadBalancerIP }}
  loadBalancerIP: {{ .Values.portalapi.loadBalancerIP }}
  {{- end }}
  {{- if .Values.portalapi.loadBalancerSourceRanges }}
  loadBalancerSourceRanges:
  {{- range $cidr := .Values.portalapi.loadBalancerSourceRanges }}
  - {{ $cidr }}
  {{- end }}
  {{- end }}
  {{- end }}
  externalIPs:
  {{- range $ip := .Values.portalapi.externalIPs }}
  - {{ $ip }}
  {{- end }}
  ports:
  {{- if .Values.portalapi.http.enabled }}
  - name: kong-portalapi
    port: {{ .Values.portalapi.http.servicePort }}
    targetPort: {{ .Values.portalapi.http.containerPort }}
  {{- if (and (eq .Values.portalapi.type "NodePort") (not (empty .Values.portalapi.http.nodePort))) }}
    nodePort: {{ .Values.portalapi.http.nodePort }}
  {{- end }}
    protocol: TCP
  {{- end }}
  {{- if or .Values.portalapi.tls.enabled }}
  - name: kong-portalapi-tls
    port: {{ .Values.portalapi.tls.servicePort }}
    targetPort: {{ .Values.portalapi.tls.containerPort }}
  {{- if (and (eq .Values.portalapi.type "NodePort") (not (empty .Values.portalapi.tls.nodePort))) }}
    nodePort: {{ .Values.portalapi.tls.nodePort }}
  {{- end }}
    protocol: TCP
  {{- end }}
  selector:
    {{- include "kong.selectorLabels" . | nindent 4 }}
{{- end -}}
 # service-kong-portal.yaml
{{- if .Values.enterprise.enabled }}
apiVersion: v1
kind: Service
metadata:
  name: {{ template "kong.fullname" . }}-portal
  annotations:
    {{- range $key, $value := .Values.portal.annotations }}
      {{ $key }}: {{ $value | quote }}
    {{- end }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
spec:
  type: {{ .Values.portal.type }}
  {{- if eq .Values.portal.type "LoadBalancer" }}
  {{- if .Values.portal.loadBalancerIP }}
  loadBalancerIP: {{ .Values.portal.loadBalancerIP }}
  {{- end }}
  {{- if .Values.portal.loadBalancerSourceRanges }}
  loadBalancerSourceRanges:
  {{- range $cidr := .Values.portal.loadBalancerSourceRanges }}
  - {{ $cidr }}
  {{- end }}
  {{- end }}
  {{- end }}
  externalIPs:
  {{- range $ip := .Values.portal.externalIPs }}
  - {{ $ip }}
  {{- end }}
  ports:
  {{- if .Values.portal.http.enabled }}
  - name: kong-portal
    port: {{ .Values.portal.http.servicePort }}
    targetPort: {{ .Values.portal.http.containerPort }}
  {{- if (and (eq .Values.portal.type "NodePort") (not (empty .Values.portal.http.nodePort))) }}
    nodePort: {{ .Values.portal.http.nodePort }}
  {{- end }}
    protocol: TCP
  {{- end }}
  {{- if or .Values.portal.tls.enabled }}
  - name: kong-portal-tls
    port: {{ .Values.portal.tls.servicePort }}
    targetPort: {{ .Values.portal.tls.containerPort }}
  {{- if (and (eq .Values.portal.type "NodePort") (not (empty .Values.portal.tls.nodePort))) }}
    nodePort: {{ .Values.portal.tls.nodePort }}
  {{- end }}
    protocol: TCP
  {{- end }}
  selector:
    {{- include "kong.selectorLabels" . | nindent 4 }}
{{- end -}}
 # service-kong-proxy.yaml
apiVersion: v1
kind: Service
metadata:
  name: {{ template "kong.fullname" . }}-proxy
  annotations:
    {{- range $key, $value := .Values.proxy.annotations }}
      {{ $key }}: {{ $value | quote }}
    {{- end }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
spec:
  type: {{ .Values.proxy.type }}
  {{- if eq .Values.proxy.type "LoadBalancer" }}
  {{- if .Values.proxy.loadBalancerIP }}
  loadBalancerIP: {{ .Values.proxy.loadBalancerIP }}
  {{- end }}
  {{- if .Values.proxy.loadBalancerSourceRanges }}
  loadBalancerSourceRanges:
  {{- range $cidr := .Values.proxy.loadBalancerSourceRanges }}
  - {{ $cidr }}
  {{- end }}
  {{- end }}
  {{- end }}
  externalIPs:
  {{- range $ip := .Values.proxy.externalIPs }}
  - {{ $ip }}
  {{- end }}
  ports:
  {{- if .Values.proxy.http.enabled }}
  - name: kong-proxy
    port: {{ .Values.proxy.http.servicePort }}
    targetPort: {{ .Values.proxy.http.containerPort }}
  {{- if (and (eq .Values.proxy.type "NodePort") (not (empty .Values.proxy.http.nodePort))) }}
    nodePort: {{ .Values.proxy.http.nodePort }}
  {{- end }}
    protocol: TCP
  {{- end }}
  {{- if or .Values.proxy.tls.enabled }}
  - name: kong-proxy-tls
    port: {{ .Values.proxy.tls.servicePort }}
    targetPort: {{ .Values.proxy.tls.overrideServiceTargetPort | default .Values.proxy.tls.containerPort }}
  {{- if (and (eq .Values.proxy.type "NodePort") (not (empty .Values.proxy.tls.nodePort))) }}
    nodePort: {{ .Values.proxy.tls.nodePort }}
  {{- end }}
    protocol: TCP
  {{- end }}
  {{- if .Values.proxy.externalTrafficPolicy }}
  externalTrafficPolicy: {{ .Values.proxy.externalTrafficPolicy }}
  {{- end }}
  {{- if .Values.proxy.clusterIP }}
  clusterIP: {{ .Values.proxy.clusterIP }}
  {{- end }}
  selector:
    {{- include "kong.selectorLabels" . | nindent 4 }}
 # servicemonitor.yaml
{{- if and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) .Values.serviceMonitor.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: {{ template "kong.fullname" . }}
  {{- if .Values.serviceMonitor.namespace }}
  namespace: {{ .Values.serviceMonitor.namespace }}
  {{- end }}
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
  {{- if .Values.serviceMonitor.labels }}
    {{ toYaml .Values.serviceMonitor.labels | nindent 4 }}
  {{- end }}
spec:
  endpoints:
  - targetPort: metrics
    scheme: http
    {{- if .Values.serviceMonitor.interval }}
    interval: {{ .Values.serviceMonitor.interval }}
    {{- end }}
  jobLabel: {{ .Release.Name }}
  namespaceSelector:
    matchNames:
    - {{ .Release.Namespace }}
  selector:
    matchLabels:
      {{- include "kong.metaLabels" . | nindent 6 }}
{{- end }}

# Default values for Kong's Helm Chart.
# Declare variables to be passed into your templates.
#
# Sections:
# - Kong parameters
# - Ingress Controller parameters
# - Postgres sub-chart parameters
# - Miscellaneous parameters
# - Kong Enterprise parameters

# -----------------------------------------------------------------------------
# Kong parameters
# -----------------------------------------------------------------------------

# Specify Kong configurations
# Kong configurations guide https://docs.konghq.com/latest/configuration
# Values here take precedence over values from other sections of values.yaml,
# e.g. setting pg_user here will override the value normally set when postgresql.enabled
# is set below. In general, you should not set values here if they are set elsewhere.
env:
  database: "off"
  nginx_worker_processes: "1"
  proxy_access_log: /dev/stdout
  admin_access_log: /dev/stdout
  admin_gui_access_log: /dev/stdout
  portal_api_access_log: /dev/stdout
  proxy_error_log: /dev/stderr
  admin_error_log: /dev/stderr
  admin_gui_error_log: /dev/stderr
  portal_api_error_log: /dev/stderr
  prefix: /kong_prefix/

# Specify Kong's Docker image and repository details here
image:
  repository: kong
  # repository: kong-docker-kong-enterprise-k8s.bintray.io/kong-enterprise-k8s
  # repository: kong-docker-kong-enterprise-edition-docker.bintray.io/kong-enterprise-edition
  tag: 1.4
  pullPolicy: IfNotPresent
  ## Optionally specify an array of imagePullSecrets.
  ## Secrets must be manually created in the namespace.
  ## If using the official Kong Enterprise registry above, you MUST provide a secret.
  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  ##
  # pullSecrets:
  #   - myRegistrKeySecretName

# Specify Kong admin service configuration
# Note: It is recommended to not use the Admin API to configure Kong
# when using Kong as an Ingress Controller.
admin:
  enabled: false
  # If you want to specify annotations for the admin service, uncomment the following
  # line, add additional or adjust as needed, and remove the curly braces after 'annotations:'.
  annotations: {}
  #  service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"

  # HTTPS traffic on the admin port
  # if set to false also set readinessProbe and livenessProbe httpGet scheme's to 'HTTP'
  useTLS: true
  servicePort: 8444
  containerPort: 8444
  # Kong admin service type
  type: NodePort
  # Set a nodePort which is available
  # nodePort: 32444
  # Kong admin ingress settings. Useful if you want to expose the Admin
  # API of Kong outside the k8s cluster.
  ingress:
    # Enable/disable exposure using ingress.
    enabled: false
    # TLS secret name.
    # tls: kong-admin.example.com-tls
    # Ingress hostname
    hostname:
    # Map of ingress annotations.
    annotations: {}
    # Ingress path.
    path: /

# Specify Kong proxy service configuration
proxy:
  # If you want to specify annotations for the proxy service, uncomment the following
  # line, add additional or adjust as needed, and remove the curly braces after 'annotations:'.
  annotations: {}
  #  service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"

  # HTTP plain-text traffic
  http:
    enabled: true
    servicePort: 80
    containerPort: 8000
    # Set a nodePort which is available if service type is NodePort
    # nodePort: 32080

  tls:
    enabled: true
    servicePort: 443
    containerPort: 8443
    # Set a target port for the TLS port in proxy service, useful when using TLS
    # termination on an ELB.
    # overrideServiceTargetPort: 8000
    # Set a nodePort which is available if service type is NodePort
    # nodePort: 32443

  type: LoadBalancer

  # Kong proxy ingress settings.
  # Note: You need this only if you are using another Ingress Controller
  # to expose Kong outside the k8s cluster.
  ingress:
    # Enable/disable exposure using ingress.
    enabled: false
    hosts: []
    # TLS section. Unlike other ingresses, this follows the format at
    # https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
    # tls:
    # - hosts:
    #   - 1.example.com
    #   secretName: example1-com-tls-secret
    # - hosts:
    #   - 2.example.net
    #   secretName: example2-net-tls-secret
    # Map of ingress annotations.
    annotations: {}
    # Ingress path.
    path: /

  externalIPs: []

# Custom Kong plugins can be loaded into Kong by mounting the plugin code
# into the file-system of Kong container.
# The plugin code should be present in ConfigMap or Secret inside the same
# namespace as Kong is being installed.
# The `name` property refers to the name of the ConfigMap or Secret
# itself, while the pluginName refers to the name of the plugin as it appears
# in Kong.
plugins: {}
  # configMaps:
  # - pluginName: rewriter
  #   name: kong-plugin-rewriter
  # secrets:
  # - pluginName: rewriter
  #   name: kong-plugin-rewriter
# Inject specified secrets as a volume in Kong Container at path /etc/secrets/{secret-name}/
# This can be used to override default SSL certificates
# Example configuration
# secretVolumes:
# - kong-proxy-tls
# - kong-admin-tls
secretVolumes: []

# Set runMigrations to run Kong migrations
runMigrations: true

# Kong's configuration for DB-less mode
# Note: Use this section only if you are deploying Kong in DB-less mode
# and not as an Ingress Controller.
dblessConfig:
  # Either Kong's configuration is managed from an existing ConfigMap (with Key: kong.yml)
  configMap: ""
  # Or the configuration is passed in full-text below
  config:
    _format_version: "1.1"
    services:
      # Example configuration
      # - name: example.com
      #   url: http://example.com
      #   routes:
      #   - name: example
      #     paths:
      #     - "/example"

# -----------------------------------------------------------------------------
# Ingress Controller parameters
# -----------------------------------------------------------------------------

# Kong Ingress Controller's primary purpose is to satisfy Ingress resources
# created in k8s.  It uses CRDs for more fine grained control over routing and
# for Kong specific configuration.
ingressController:
  enabled: true
  image:
    repository: kong-docker-kubernetes-ingress-controller.bintray.io/kong-ingress-controller
    tag: 0.7.0

  # Specify Kong Ingress Controller configuration via environment variables
  env: {}

  admissionWebhook:
    enabled: false
    failurePolicy: Fail
    port: 8080

  ingressClass: kong

  rbac:
    # Specifies whether RBAC resources should be created
    create: true

  serviceAccount:
    # Specifies whether a ServiceAccount should be created
    create: true
    # The name of the ServiceAccount to use.
    # If not set and create is true, a name is generated using the fullname template
    name:

  installCRDs: true

  # general properties
  livenessProbe:
    httpGet:
      path: "/healthz"
      port: 10254
      scheme: HTTP
    initialDelaySeconds: 5
    timeoutSeconds: 5
    periodSeconds: 10
    successThreshold: 1
    failureThreshold: 3
  readinessProbe:
    httpGet:
      path: "/healthz"
      port: 10254
      scheme: HTTP
    initialDelaySeconds: 5
    timeoutSeconds: 5
    periodSeconds: 10
    successThreshold: 1
    failureThreshold: 3
  resources: {}

# -----------------------------------------------------------------------------
# Postgres sub-chart parameters
# -----------------------------------------------------------------------------

# Kong can run without a database or use either Postgres or Cassandra
# as a backend datatstore for it's configuration.
# By default, this chart installs Kong without a database.

# If you would like to use a database, there are two options:
# - (recommended) Deploy and maintain a database and pass the connection
#   details to Kong via the `env` section.
# - You can use the below `postgresql` sub-chart to deploy a database
#   along-with Kong as part of a single Helm release.

# PostgreSQL chart documentation:
# https://github.com/helm/charts/blob/master/stable/postgresql/README.md

postgresql:
  enabled: false
  # postgresqlUsername: kong
  # postgresqlDatabase: kong
  # service:
  #   port: 5432

# -----------------------------------------------------------------------------
# Miscellaneous parameters
# -----------------------------------------------------------------------------

waitImage:
  repository: busybox
  tag: latest
  pullPolicy: IfNotPresent

# update strategy
updateStrategy: {}
  # type: RollingUpdate
  # rollingUpdate:
  #   maxSurge: "100%"
  #   maxUnavailable: "0%"

# If you want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
resources: {}
  # limits:
  #  cpu: 100m
  #  memory: 128Mi
  # requests:
  #  cpu: 100m
  #  memory: 128Mi

# readinessProbe for Kong pods
# If using Kong Enterprise with RBAC, you must add a Kong-Admin-Token header
readinessProbe:
  httpGet:
    path: "/status"
    port: metrics
    scheme: HTTP
  initialDelaySeconds: 5
  timeoutSeconds: 5
  periodSeconds: 10
  successThreshold: 1
  failureThreshold: 3

# livenessProbe for Kong pods
livenessProbe:
  httpGet:
    path: "/status"
    port: metrics
    scheme: HTTP
  initialDelaySeconds: 5
  timeoutSeconds: 5
  periodSeconds: 10
  successThreshold: 1
  failureThreshold: 3

# Affinity for pod assignment
# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
# affinity: {}

# Tolerations for pod assignment
# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
tolerations: []

# Node labels for pod assignment
# Ref: https://kubernetes.io/docs/user-guide/node-selection/
nodeSelector: {}

# Annotation to be added to Kong pods
podAnnotations: {}

# Kong pod count
replicaCount: 1

# Kong Pod Disruption Budget
podDisruptionBudget:
  enabled: false
  maxUnavailable: "50%"

podSecurityPolicy:
  enabled: false

# securityContext for Kong pods.
securityContext:
  runAsUser: 1000

serviceMonitor:
  # Specifies whether ServiceMonitor for Prometheus operator should be created
  enabled: false
  # interval: 10s
  # Specifies namespace, where ServiceMonitor should be installed
  # namespace: monitoring
  # labels:
  #   foo: bar

# -----------------------------------------------------------------------------
# Kong Enterprise parameters
# -----------------------------------------------------------------------------

# Toggle Kong Enterprise features on or off
# RBAC and SMTP configuration have additional options that must all be set together
# Other settings should be added to the "env" settings below
enterprise:
  enabled: false
  # Kong Enterprise license secret name
  # This secret must contain a single 'license' key, containing your base64-encoded license data
  # The license secret is required for all Kong Enterprise deployments
  license_secret: you-must-create-a-kong-license-secret
  # Session configuration secret
  # The session conf secret is required if using RBAC or the Portal
  vitals:
    enabled: true
  portal:
    enabled: false
    # portal_auth here sets the default authentication mechanism for the Portal
    # FIXME This can be changed per-workspace, but must currently default to
    # basic-auth to work around limitations with session configuration
    portal_auth: basic-auth
    # If the Portal is enabled and any workspace's Portal uses authentication,
    # this Secret must contain an portal_session_conf key
    # The key value must be a secret configuration, following the example at
    # https://docs.konghq.com/enterprise/latest/developer-portal/configuration/authentication/sessions
    session_conf_secret: you-must-create-a-portal-session-conf-secret
  rbac:
    enabled: false
    admin_gui_auth: basic-auth
    # If RBAC is enabled, this Secret must contain an admin_gui_session_conf key
    # The key value must be a secret configuration, following the example at
    # https://docs.konghq.com/enterprise/latest/kong-manager/authentication/sessions
    session_conf_secret: you-must-create-an-rbac-session-conf-secret
    # If admin_gui_auth is not set to basic-auth, provide a secret name which
    # has an admin_gui_auth_conf key containing the plugin config JSON
    admin_gui_auth_conf_secret: you-must-create-an-admin-gui-auth-conf-secret
  # For configuring emails and SMTP, please read through:
  # https://docs.konghq.com/enterprise/latest/developer-portal/configuration/smtp
  # https://docs.konghq.com/enterprise/latest/kong-manager/networking/email
  smtp:
    enabled: false
    portal_emails_from: none@example.com
    portal_emails_reply_to: none@example.com
    admin_emails_from: none@example.com
    admin_emails_reply_to: none@example.com
    smtp_admin_emails: none@example.com
    smtp_host: smtp.example.com
    smtp_port: 587
    smtp_starttls: true
    auth:
      # If your SMTP server does not require authentication, this section can
      # be left as-is. If smtp_username is set to anything other than an empty
      # string, you must create a Secret with an smtp_password key containing
      # your SMTP password and specify its name here.
      smtp_username: ''  # e.g. postmaster@example.com
      smtp_password_secret: you-must-create-an-smtp-password

manager:
  # If you want to specify annotations for the Manager service, uncomment the following
  # line, add additional or adjust as needed, and remove the curly braces after 'annotations:'.
  annotations: {}
  #  service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"

  # HTTP plain-text traffic
  http:
    enabled: true
    servicePort: 8002
    containerPort: 8002
    # Set a nodePort which is available if service type is NodePort
    # nodePort: 32080

  tls:
    enabled: true
    servicePort: 8445
    containerPort: 8445
    # Set a nodePort which is available if service type is NodePort
    # nodePort: 32443

  type: NodePort

  # Kong proxy ingress settings.
  ingress:
    # Enable/disable exposure using ingress.
    enabled: false
    # TLS secret name.
    # tls: kong-proxy.example.com-tls
    # Ingress hostname
    hostname:
    # Map of ingress annotations.
    annotations: {}
    # Ingress path.
    path: /

  externalIPs: []

portal:
  # If you want to specify annotations for the Portal service, uncomment the following
  # line, add additional or adjust as needed, and remove the curly braces after 'annotations:'.
  annotations: {}
  #  service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"

  # HTTP plain-text traffic
  http:
    enabled: true
    servicePort: 8003
    containerPort: 8003
    # Set a nodePort which is available if service type is NodePort
    # nodePort: 32080

  tls:
    enabled: true
    servicePort: 8446
    containerPort: 8446
    # Set a nodePort which is available if service type is NodePort
    # nodePort: 32443

  type: NodePort

  # Kong proxy ingress settings.
  ingress:
    # Enable/disable exposure using ingress.
    enabled: false
    # TLS secret name.
    # tls: kong-proxy.example.com-tls
    # Ingress hostname
    hostname:
    # Map of ingress annotations.
    annotations: {}
    # Ingress path.
    path: /

  externalIPs: []

portalapi:
  # If you want to specify annotations for the Portal API service, uncomment the following
  # line, add additional or adjust as needed, and remove the curly braces after 'annotations:'.
  annotations: {}
  #  service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"

  # HTTP plain-text traffic
  http:
    enabled: true
    servicePort: 8004
    containerPort: 8004
    # Set a nodePort which is available if service type is NodePort
    # nodePort: 32080

  tls:
    enabled: true
    servicePort: 8447
    containerPort: 8447
    # Set a nodePort which is available if service type is NodePort
    # nodePort: 32443

  type: NodePort

  # Kong proxy ingress settings.
  ingress:
    # Enable/disable exposure using ingress.
    enabled: false
    # TLS secret name.
    # tls: kong-proxy.example.com-tls
    # Ingress hostname
    hostname:
    # Map of ingress annotations.
    annotations: {}
    # Ingress path.
    path: /

  externalIPs: []
