# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "kuberos.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "kuberos.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "kuberos.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{- define "kuberos.defaultCluster" -}}
{{- printf "%s"  (index .Values.kuberos.clusters 0).name -}}
{{- end -}}

 # configmap.yaml
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "kuberos.fullname" . }}-config
data:
  template: |-
    apiVersion: v1
    kind: Config
    current-context: {{ (index .Values.kuberos.clusters 0).name  }}
    clusters:
    {{ range .Values.kuberos.clusters }}
    - name: {{ .name | quote }}
      cluster:
        certificate-authority-data: {{ .caCrt | b64enc | quote }}
        server: {{ .apiServer }}
    {{- end }}
 # deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "kuberos.fullname" . }}
  labels:
    app: {{ template "kuberos.name" . }}
    chart: {{ template "kuberos.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . |  sha256sum | trunc 63 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      app: {{ template "kuberos.name" . }}
      release: {{ .Release.Name }}
  template:
    metadata:
      labels:
        app: {{ template "kuberos.name" . }}
        release: {{ .Release.Name }}
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . |  sha256sum | trunc 63 }}
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }}
    spec:
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command: ["/kuberos", "{{ .Values.kuberos.oidcClientURL }}", "{{ .Values.kuberos.oidcClientID }}", "/cfg/secret", "/cfg/template"]
          ports:
            - name: kuberos-port
              containerPort: 10003
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /healthz
              port: kuberos-port
          readinessProbe:
            httpGet:
              path: /healthz
              port: kuberos-port
          resources:
{{ toYaml .Values.resources | indent 12 }}
          volumeMounts:
          - mountPath: /cfg/template
            name: template
            subPath: template
          - mountPath: /cfg/secret
            name: secret
            subPath: oidcSecret
      volumes:
      - name: template
        configMap:
          name: {{ template "kuberos.fullname" . }}-config
      - name: secret
        secret:
          secretName: {{ template "kuberos.name" . }}-secret
    {{- with .Values.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
    {{- end }}
 # ingress.yaml
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "kuberos.fullname" . -}}
{{- $servicePort := .Values.service.port -}}
{{- $ingressPath := .Values.ingress.path -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ $fullName }}
  labels:
    app: {{ template "kuberos.name" . }}
    chart: {{ template "kuberos.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
  annotations:
    ingress.kubernetes.io/rewrite-target: /
{{- with .Values.ingress.annotations }}
{{ toYaml . | indent 4 }}
{{- end }}
spec:
{{- if .Values.ingress.tls }}
  tls:
  {{- range .Values.ingress.tls }}
    - hosts:
      {{- range .hosts }}
        - {{ . }}
      {{- end }}
      secretName: {{ .secretName }}
  {{- end }}
{{- end }}
  rules:
  {{- range .Values.ingress.hosts }}
    - host: {{ . }}
      http:
        paths:
          - path: {{ $ingressPath }}
            backend:
              serviceName: {{ $fullName }}
              servicePort: http
  {{- end }}
{{- end }}
 # secrets.yaml
---
{{- if .Values.kuberos.oidcSecret -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "kuberos.name" . }}-secret
type: Opaque
data:
  oidcSecret: {{ .Values.kuberos.oidcSecret | b64enc | quote }}
{{- end }}
 # service.yaml
apiVersion: v1
kind: Service
metadata:
  name: {{ template "kuberos.fullname" . }}
  labels:
    app: {{ template "kuberos.name" . }}
    chart: {{ template "kuberos.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
{{- if .Values.service.annotations }}
  annotations:
{{ toYaml .Values.service.annotations | indent 4 }}
{{- end }}
spec:
  type: {{ .Values.service.type }}
  ports:
    - port: {{ .Values.service.port }}
      targetPort: kuberos-port
      protocol: TCP
      name: http
  selector:
    app: {{ template "kuberos.name" . }}
    release: {{ .Release.Name }}

# Default values for kuberos.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 1

# You probably want to change the values under `kuberos` and `ingress`

# `kuberos` describes the config for the app
kuberos:
  oidcClientURL: https://accounts.google.com
  # `oidcClientURL` is the endpoint that is used to quesry OIDC info
  oidcClientID: REDACTED.apps.googleusercontent.com
  # `oidcClientID` is typically a long alpha numeric string.
  #   For G Suite the 'REDACTED' part is about 45 alphanumeric characters
  oidcSecret: super-secret-value-here
  # `oidcSecret` is typically a long alpha numeric string.
  #   For G Suite it's about 25 alphanumeric characters
  #   For security reasons it's best to set this at deployment time with
  #     `--set kuberos.oidcSecret=mySuper-secretPassPhrase`
  clusters:
  # The clusters below must all use the same OIDC details above
  #   The config snippet that is generated for a user will default
  #   to the first cluster
  - name: dev-cluster
    # `name` is a label to apply to the cluster. It would normally be
    #   the fqdn of the cluster eg dev-cluster.example.com
    #   it can be something a little more friendly eg dev-cluster
    apiServer: https://api.dev-cluster.example.com
    # `apiServer` is the url for kubectl
    #   This is typically  https://api.fqdn
    caCrt: |-
      -----BEGIN CERTIFICATE-----
      cert data here
      -----END CERTIFICATE-----
    # `caCrt` is the public / CA cert for the cluster

ingress:
  enabled: false
  # Set `enabled` to true to create an ingress and get external traffic to kuberos
  annotations: {}
  # Add your ingress annotations here. Most common ones are given below
    # kubernetes.io/ingress.class: nginx
    # certmanager.k8s.io/cluster-issuer:      prod-acme
    # certmanager.k8s.io/acme-challenge-type: http01
    # nginx.ingress.kubernetes.io/force-ssl-redirect: true
  path: /
  # `path` can stay as-is
  hosts:
  # Add host headers and cert names below
    - chart-example.local
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

image:
  repository: negz/kuberos
  tag: ede4085
  pullPolicy: IfNotPresent

service:
  type: ClusterIP
  port: 80
  annotations: {}
  # Add your service annotations here.

resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #  cpu: 100m
  #  memory: 128Mi
  # requests:
  #  cpu: 100m
  #  memory: 128Mi

nodeSelector: {}

tolerations: []

affinity: {}
