# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "sentry.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "sentry.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "sentry.postgresql.fullname" -}}
{{- if .Values.postgresql.fullnameOverride -}}
{{- .Values.postgresql.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.postgresql.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name "sentry-postgresql" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{- define "sentry.redis.fullname" -}}
{{- if .Values.redis.fullnameOverride -}}
{{- .Values.redis.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.redis.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name "sentry-redis" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{- define "sentry.smtp.fullname" -}}
{{- printf "%s-%s" .Release.Name "sentry-smtp" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Set postgres host
*/}}
{{- define "sentry.postgresql.host" -}}
{{- if .Values.postgresql.enabled -}}
{{- template "sentry.postgresql.fullname" . -}}
{{- else -}}
{{- .Values.postgresql.postgresqlHost | quote -}}
{{- end -}}
{{- end -}}

{{/*
Set postgres secret
*/}}
{{- define "sentry.postgresql.secret" -}}
{{- if .Values.postgresql.enabled -}}
{{- template "sentry.postgresql.fullname" . -}}
{{- else -}}
{{- template "sentry.fullname" . -}}
{{- end -}}
{{- end -}}

{{/*
Set postgres secretKey
*/}}
{{- define "sentry.postgresql.secretKey" -}}
{{- if .Values.postgresql.enabled -}}
"postgresql-password"
{{- else -}}
{{- default "postgresql-password" .Values.postgresql.existingSecretKey | quote -}}
{{- end -}}
{{- end -}}

{{/*
Set postgres port
*/}}
{{- define "sentry.postgresql.port" -}}
{{- if .Values.postgresql.enabled -}}
    "5432"
{{- else -}}
{{- default "5432" .Values.postgresql.postgresqlPort | quote -}}
{{- end -}}
{{- end -}}

{{/*
Set redis host
*/}}
{{- define "sentry.redis.host" -}}
{{- if .Values.redis.enabled -}}
{{- template "sentry.redis.fullname" . -}}-master
{{- else -}}
{{- .Values.redis.host | quote -}}
{{- end -}}
{{- end -}}

{{/*
Set redis secret
*/}}
{{- define "sentry.redis.secret" -}}
{{- if .Values.redis.enabled -}}
{{- template "sentry.redis.fullname" . -}}
{{- else -}}
{{- template "sentry.fullname" . -}}
{{- end -}}
{{- end -}}

{{/*
Set redis secretKey
*/}}
{{- define "sentry.redis.secretKey" -}}
{{- if .Values.redis.enabled -}}
"redis-password"
{{- else -}}
{{- default "redis-password" .Values.redis.existingSecretKey | quote -}}
{{- end -}}
{{- end -}}

{{/*
Set redis port
*/}}
{{- define "sentry.redis.port" -}}
{{- if .Values.redis.enabled -}}
    "6379"
{{- else -}}
{{- default "6379" .Values.redis.port | quote -}}
{{- end -}}
{{- end -}}

{{/*
Create the name of the service account to use
*/}}
{{- define "sentry.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
    {{ default (include "sentry.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
    {{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
 # configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "sentry.fullname" . }}
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
data:
  config.yml: |-
    # While a lot of configuration in Sentry can be changed via the UI, for all
    # new-style config (as of 8.0) you can also declare values here in this file
    # to enforce defaults or to ensure they cannot be changed via the UI. For more
    # information see the Sentry documentation.

    ###############
    # Mail Server #
    ###############

    # mail.backend: 'smtp'  # Use dummy if you want to disable email entirely
    # mail.host: 'localhost'
    # mail.port: 25
    # mail.username: ''
    # mail.password: ''
    # mail.use-tls: false
    # The email address to send on behalf of
    # mail.from: 'root@localhost'

    # If you'd like to configure email replies, enable this.
    # mail.enable-replies: false

    # When email-replies are enabled, this value is used in the Reply-To header
    # mail.reply-hostname: ''

    # If you're using mailgun for inbound mail, set your API key and configure a
    # route to forward to /api/hooks/mailgun/inbound/
    # mail.mailgun-api-key: ''

    ###################
    # System Settings #
    ###################

    # If this file ever becomes compromised, it's important to regenerate your a new key
    # Changing this value will result in all current sessions being invalidated.
    # A new key can be generated with `$ sentry config generate-secret-key`
    # system.secret-key: 'changeme'

    # The ``redis.clusters`` setting is used, unsurprisingly, to configure Redis
    # clusters. These clusters can be then referred to by name when configuring
    # backends such as the cache, digests, or TSDB backend.
    # redis.clusters:
    #   default:
    #     hosts:
    #       0:
    #         host: 127.0.0.1
    #         port: 6379

    ################
    # File storage #
    ################

    # Uploaded media uses these `filestore` settings. The available
    # backends are either `filesystem` or `s3`.

    filestore.backend: '{{ .Values.filestore.backend }}'
    {{- if eq .Values.filestore.backend "filesystem" }}
    filestore.options:
      location: '{{ .Values.filestore.filesystem.path }}'

    {{ end }}
    {{- if eq .Values.filestore.backend "gcs" }}
    filestore.options:
      bucket_name: '{{ .Values.filestore.gcs.bucketName }}'

    {{ end }}
    {{- if eq .Values.filestore.backend "s3" }}
    filestore.options:
      {{- if .Values.filestore.s3.bucketName }}
      bucket_name: '{{ .Values.filestore.s3.bucketName }}'
      {{- end }}
      {{- if .Values.filestore.s3.endpointUrl }}
      endpoint_url: '{{ .Values.filestore.s3.endpointUrl }}'
      {{- end }}
      {{- if .Values.filestore.s3.signature_version }}
      signature_version: '{{ .Values.filestore.s3.signature_version }}'
      {{- end }}
      {{- if .Values.filestore.s3.region_name }}
      region_name: '{{ .Values.filestore.s3.region_name }}'
      {{- end }}
      {{- if .Values.filestore.s3.default_acl }}
      default_acl: '{{ .Values.filestore.s3.default_acl }}'
      {{- end }}
    {{ end }}

{{ .Values.config.configYml | indent 4 }}
  sentry.conf.py: |-
    # This file is just Python, with a touch of Django which means
    # you can inherit and tweak settings to your hearts content.

    # For Docker, the following environment variables are supported:
    #  SENTRY_POSTGRES_HOST
    #  SENTRY_POSTGRES_PORT
    #  SENTRY_DB_NAME
    #  SENTRY_DB_USER
    #  SENTRY_DB_PASSWORD
    #  SENTRY_RABBITMQ_HOST
    #  SENTRY_RABBITMQ_USERNAME
    #  SENTRY_RABBITMQ_PASSWORD
    #  SENTRY_RABBITMQ_VHOST
    #  SENTRY_REDIS_HOST
    #  SENTRY_REDIS_PASSWORD
    #  SENTRY_REDIS_PORT
    #  SENTRY_REDIS_DB
    #  SENTRY_MEMCACHED_HOST
    #  SENTRY_MEMCACHED_PORT
    #  SENTRY_FILESTORE_DIR
    #  SENTRY_SERVER_EMAIL
    #  SENTRY_EMAIL_HOST
    #  SENTRY_EMAIL_PORT
    #  SENTRY_EMAIL_USER
    #  SENTRY_EMAIL_PASSWORD
    #  SENTRY_EMAIL_USE_TLS
    #  SENTRY_EMAIL_LIST_NAMESPACE
    #  SENTRY_ENABLE_EMAIL_REPLIES
    #  SENTRY_SMTP_HOSTNAME
    #  SENTRY_MAILGUN_API_KEY
    #  SENTRY_SINGLE_ORGANIZATION
    #  SENTRY_SECRET_KEY
    #  (slack integration)
    #  SENTRY_SLACK_CLIENT_ID
    #  SENTRY_SLACK_CLIENT_SECRET
    #  SENTRY_SLACK_VERIFICATION_TOKEN
    #  (github plugin, sso)
    #  GITHUB_APP_ID
    #  GITHUB_API_SECRET
    #  (github integration)
    #  SENTRY_GITHUB_APP_ID
    #  SENTRY_GITHUB_APP_CLIENT_ID
    #  SENTRY_GITHUB_APP_CLIENT_SECRET
    #  SENTRY_GITHUB_APP_WEBHOOK_SECRET
    #  SENTRY_GITHUB_APP_PRIVATE_KEY
    #  (azure devops integration)
    #  SENTRY_VSTS_CLIENT_ID
    #  SENTRY_VSTS_CLIENT_SECRET
    #  (bitbucket plugin)
    #  BITBUCKET_CONSUMER_KEY
    #  BITBUCKET_CONSUMER_SECRET
    from sentry.conf.server import *  # NOQA
    from sentry.utils.types import Bool, Int

    import os
    import os.path
    import six

    CONF_ROOT = os.path.dirname(__file__)

    postgres = env('SENTRY_POSTGRES_HOST') or (env('POSTGRES_PORT_5432_TCP_ADDR') and 'postgres')
    if postgres:
        DATABASES = {
            'default': {
                'ENGINE': 'sentry.db.postgres',
                'NAME': (
                    env('SENTRY_DB_NAME')
                    or env('POSTGRES_ENV_POSTGRES_USER')
                    or 'postgres'
                ),
                'USER': (
                    env('SENTRY_DB_USER')
                    or env('POSTGRES_ENV_POSTGRES_USER')
                    or 'postgres'
                ),
                'PASSWORD': (
                    env('SENTRY_DB_PASSWORD')
                    or env('POSTGRES_ENV_POSTGRES_PASSWORD')
                    or ''
                ),
                'HOST': postgres,
                'PORT': (
                    env('SENTRY_POSTGRES_PORT')
                    or ''
                ),
            },
        }

    # You should not change this setting after your database has been created
    # unless you have altered all schemas first
    SENTRY_USE_BIG_INTS = True

    # If you're expecting any kind of real traffic on Sentry, we highly recommend
    # configuring the CACHES and Redis settings

    ###########
    # General #
    ###########

    # Instruct Sentry that this install intends to be run by a single organization
    # and thus various UI optimizations should be enabled.
    SENTRY_SINGLE_ORGANIZATION = env('SENTRY_SINGLE_ORGANIZATION', True)

    #########
    # Redis #
    #########

    # Generic Redis configuration used as defaults for various things including:
    # Buffers, Quotas, TSDB

    redis = env('SENTRY_REDIS_HOST') or (env('REDIS_PORT_6379_TCP_ADDR') and 'redis')
    if not redis:
        raise Exception('Error: REDIS_PORT_6379_TCP_ADDR (or SENTRY_REDIS_HOST) is undefined, did you forget to `--link` a redis container?')

    redis_password = env('SENTRY_REDIS_PASSWORD') or ''
    redis_port = env('SENTRY_REDIS_PORT') or '6379'
    redis_db = env('SENTRY_REDIS_DB') or '0'

    SENTRY_OPTIONS.update({
        'redis.clusters': {
            'default': {
                'hosts': {
                    0: {
                        'host': redis,
                        'password': redis_password,
                        'port': redis_port,
                        'db': redis_db,
                    },
                },
            },
        },
    })

    #########
    # Cache #
    #########

    # Sentry currently utilizes two separate mechanisms. While CACHES is not a
    # requirement, it will optimize several high throughput patterns.

    memcached = env('SENTRY_MEMCACHED_HOST') or (env('MEMCACHED_PORT_11211_TCP_ADDR') and 'memcached')
    if memcached:
        memcached_port = (
            env('SENTRY_MEMCACHED_PORT')
            or '11211'
        )
        CACHES = {
            'default': {
                'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
                'LOCATION': [memcached + ':' + memcached_port],
                'TIMEOUT': 3600,
            }
        }

    # A primary cache is required for things such as processing events
    SENTRY_CACHE = 'sentry.cache.redis.RedisCache'

    #########
    # Queue #
    #########

    # See https://docs.getsentry.com/on-premise/server/queue/ for more
    # information on configuring your queue broker and workers. Sentry relies
    # on a Python framework called Celery to manage queues.

    rabbitmq = env('SENTRY_RABBITMQ_HOST') or (env('RABBITMQ_PORT_5672_TCP_ADDR') and 'rabbitmq')

    if rabbitmq:
        BROKER_URL = (
            'amqp://' + (
                env('SENTRY_RABBITMQ_USERNAME')
                or env('RABBITMQ_ENV_RABBITMQ_DEFAULT_USER')
                or 'guest'
            ) + ':' + (
                env('SENTRY_RABBITMQ_PASSWORD')
                or env('RABBITMQ_ENV_RABBITMQ_DEFAULT_PASS')
                or 'guest'
            ) + '@' + rabbitmq + '/' + (
                env('SENTRY_RABBITMQ_VHOST')
                or env('RABBITMQ_ENV_RABBITMQ_DEFAULT_VHOST')
                or '/'
            )
        )
    else:
        BROKER_URL = 'redis://:' + redis_password + '@' + redis + ':' + redis_port + '/' + redis_db


    ###############
    # Rate Limits #
    ###############

    # Rate limits apply to notification handlers and are enforced per-project
    # automatically.

    SENTRY_RATELIMITER = 'sentry.ratelimits.redis.RedisRateLimiter'

    ##################
    # Update Buffers #
    ##################

    # Buffers (combined with queueing) act as an intermediate layer between the
    # database and the storage API. They will greatly improve efficiency on large
    # numbers of the same events being sent to the API in a short amount of time.
    # (read: if you send any kind of real data to Sentry, you should enable buffers)

    SENTRY_BUFFER = 'sentry.buffer.redis.RedisBuffer'

    ##########
    # Quotas #
    ##########

    # Quotas allow you to rate limit individual projects or the Sentry install as
    # a whole.

    SENTRY_QUOTAS = 'sentry.quotas.redis.RedisQuota'

    ########
    # TSDB #
    ########

    # The TSDB is used for building charts as well as making things like per-rate
    # alerts possible.

    SENTRY_TSDB = 'sentry.tsdb.redis.RedisTSDB'

    ###########
    # Digests #
    ###########

    # The digest backend powers notification summaries.

    SENTRY_DIGESTS = 'sentry.digests.backends.redis.RedisBackend'

    ##############
    # Web Server #
    ##############

    # If you're using a reverse SSL proxy, you should enable the X-Forwarded-Proto
    # header and set `SENTRY_USE_SSL=1`

    if env('SENTRY_USE_SSL', False):
        SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
        SESSION_COOKIE_SECURE = True
        CSRF_COOKIE_SECURE = True
        SOCIAL_AUTH_REDIRECT_IS_HTTPS = True

    SENTRY_WEB_HOST = '0.0.0.0'
    SENTRY_WEB_PORT = 9000
    SENTRY_WEB_OPTIONS = {
        'http': '%s:%s' % (SENTRY_WEB_HOST, SENTRY_WEB_PORT),
        'protocol': 'uwsgi',
        # This is need to prevent https://git.io/fj7Lw
        'uwsgi-socket': None,
        'http-keepalive': True,
        'memory-report': False,
        # 'workers': 3,  # the number of web workers
    }

    ###############
    # Mail Server #
    ###############

    email = env('SENTRY_EMAIL_HOST') or (env('SMTP_PORT_25_TCP_ADDR') and 'smtp')
    if email:
        SENTRY_OPTIONS['mail.backend'] = 'smtp'
        SENTRY_OPTIONS['mail.host'] = email
        SENTRY_OPTIONS['mail.from'] = env('SENTRY_SERVER_EMAIL')
        SENTRY_OPTIONS['mail.username'] = env('SENTRY_EMAIL_USER') or ''
        SENTRY_OPTIONS['mail.password'] = env('SENTRY_EMAIL_PASSWORD') or ''
        SENTRY_OPTIONS['mail.port'] = int(env('SENTRY_EMAIL_PORT') or 25)
        SENTRY_OPTIONS['mail.use-tls'] = env('SENTRY_EMAIL_USE_TLS', False)
        SENTRY_OPTIONS['mail.list-namespace'] = env('SENTRY_EMAIL_LIST_NAMESPACE') or 'localhost'
    else:
        SENTRY_OPTIONS['mail.backend'] = 'dummy'

    # The email address to send on behalf of
    SENTRY_OPTIONS['mail.from'] = env('SENTRY_SERVER_EMAIL') or 'root@localhost'
    # If you're using mailgun for inbound mail, set your API key and configure a
    # route to forward to /api/hooks/mailgun/inbound/
    SENTRY_OPTIONS['mail.mailgun-api-key'] = env('SENTRY_MAILGUN_API_KEY') or ''
    # If you specify a MAILGUN_API_KEY, you definitely want EMAIL_REPLIES
    if SENTRY_OPTIONS['mail.mailgun-api-key']:
        SENTRY_OPTIONS['mail.enable-replies'] = True
    else:
        SENTRY_OPTIONS['mail.enable-replies'] = env('SENTRY_ENABLE_EMAIL_REPLIES', False)
    if SENTRY_OPTIONS['mail.enable-replies']:
        SENTRY_OPTIONS['mail.reply-hostname'] = env('SENTRY_SMTP_HOSTNAME') or ''



    ##########
    # Docker #
    ##########

    # Docker's environment configuration needs to happen
    # prior to anything that might rely on these values to
    # enable more "smart" configuration.

    ENV_CONFIG_MAPPING = {
        'SENTRY_SECRET_KEY': 'system.secret-key',

        'SENTRY_SLACK_CLIENT_ID': 'slack.client-id',
        'SENTRY_SLACK_CLIENT_SECRET': 'slack.client-secret',
        'SENTRY_SLACK_VERIFICATION_TOKEN': 'slack.verification-token',

        'SENTRY_GITHUB_APP_ID': ('github-app.id', Int),
        'SENTRY_GITHUB_APP_CLIENT_ID': 'github-app.client-id',
        'SENTRY_GITHUB_APP_CLIENT_SECRET': 'github-app.client-secret',
        'SENTRY_GITHUB_APP_WEBHOOK_SECRET': 'github-app.webhook-secret',
        'SENTRY_GITHUB_APP_PRIVATE_KEY': 'github-app.private-key',

        'SENTRY_VSTS_CLIENT_ID': 'vsts.client-id',
        'SENTRY_VSTS_CLIENT_SECRET': 'vsts.client-secret',
        'GOOGLE_CLIENT_ID': 'auth-google.client-id',
        'GOOGLE_CLIENT_SECRET': 'auth-google.client-secret',
    }


    def bind_env_config(config=SENTRY_OPTIONS, mapping=ENV_CONFIG_MAPPING):
        """
        Automatically bind SENTRY_OPTIONS from a set of environment variables.
        """
        for env_var, item in six.iteritems(mapping):
            # HACK: we need to check both in `os.environ` and `env._cache`.
            # This is very much an implementation detail leaking out
            # due to assumptions about how `env` would be used previously.
            # `env` will pop values out of `os.environ` when they are seen,
            # so checking against `os.environ` only means it's likely
            # they won't exist if `env()` has been called on the variable
            # before at any point. So we're choosing to check both, but this
            # behavior is different since we're trying to only conditionally
            # apply variables, instead of setting them always.
            if env_var not in os.environ and env_var not in env._cache:
                continue
            if isinstance(item, tuple):
                opt_key, type_ = item
            else:
                opt_key, type_ = item, None
            config[opt_key] = env(env_var, type=type_)

    # If this value ever becomes compromised, it's important to regenerate your
    # SENTRY_SECRET_KEY. Changing this value will result in all current sessions
    # being invalidated.
    secret_key = env('SENTRY_SECRET_KEY')
    if not secret_key:
        raise Exception('Error: SENTRY_SECRET_KEY is undefined, run `generate-secret-key` and set to -e SENTRY_SECRET_KEY')

    if 'SENTRY_RUNNING_UWSGI' not in os.environ and len(secret_key) < 32:
        print('!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!')
        print('!!                    CAUTION                       !!')
        print('!! Your SENTRY_SECRET_KEY is potentially insecure.  !!')
        print('!!    We recommend at least 32 characters long.     !!')
        print('!!     Regenerate with `generate-secret-key`.       !!')
        print('!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!')

    # Grab the easy configuration first - these are all fixed
    # key=value with no logic behind them
    bind_env_config()

    # If you specify a MAILGUN_API_KEY, you definitely want EMAIL_REPLIES
    if SENTRY_OPTIONS.get('mail.mailgun-api-key'):
        SENTRY_OPTIONS.setdefault('mail.enable-replies', True)

    if 'GITHUB_APP_ID' in os.environ:
        GITHUB_EXTENDED_PERMISSIONS = ['repo']
        GITHUB_APP_ID = env('GITHUB_APP_ID')
        GITHUB_API_SECRET = env('GITHUB_API_SECRET')

    if 'BITBUCKET_CONSUMER_KEY' in os.environ:
        BITBUCKET_CONSUMER_KEY = env('BITBUCKET_CONSUMER_KEY')
        BITBUCKET_CONSUMER_SECRET = env('BITBUCKET_CONSUMER_SECRET')

{{- if .Values.metrics.enabled }}
    SENTRY_METRICS_BACKEND = 'sentry.metrics.statsd.StatsdMetricsBackend'
    SENTRY_METRICS_OPTIONS = {
        'host': '{{ template "sentry.fullname" . }}-metrics',
        'port': 9125,
    }
{{- end }}

{{ .Values.config.sentryConfPy | indent 4 }}
 # cron-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "sentry.fullname" . }}-cron
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  selector:
    matchLabels:
        app: {{ template "sentry.fullname" . }}
        release: "{{ .Release.Name }}"
        role: cron
  replicas: {{ .Values.cron.replicacount }}
  template:
    metadata:
      annotations:
        metrics-enabled: {{ .Values.metrics.enabled | quote }}
        checksum/configYml: {{ .Values.config.configYml | sha256sum }}
        checksum/sentryConfPy: {{ .Values.config.sentryConfPy | sha256sum }}
        checksum/secrets.yaml: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
      {{- if .Values.cron.podAnnotations }}
{{ toYaml .Values.cron.podAnnotations | indent 8 }}
      {{- end }}
      labels:
        app: {{ template "sentry.fullname" . }}
        release: "{{ .Release.Name }}"
        role: cron
        {{- if .Values.cron.podLabels }}
{{ toYaml .Values.cron.podLabels | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: {{ template "sentry.serviceAccountName" . }}
      {{- if .Values.cron.affinity }}
      affinity:
{{ toYaml .Values.cron.affinity | indent 8 }}
      {{- end }}
      {{- if .Values.cron.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.cron.nodeSelector | indent 8 }}
      {{- end }}
      {{- if .Values.cron.tolerations }}
      tolerations:
{{ toYaml .Values.cron.tolerations | indent 8 }}
      {{- end }}
      {{- if .Values.cron.schedulerName }}
      schedulerName: "{{ .Values.cron.schedulerName }}"
      {{- end }}
      {{- if .Values.image.imagePullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.image.imagePullSecrets | indent 8 }}
      {{- end }}
      containers:
      - name: {{ .Chart.Name }}-cron
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        args: ["run", "cron"]
        ports:
        - containerPort: {{ .Values.service.internalPort }}
        env:
        - name: SENTRY_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: {{ template "sentry.fullname" . }}
              key: sentry-secret
        - name: SENTRY_DB_USER
          value: {{ default "sentry" .Values.postgresql.postgresqlUsername | quote }}
        - name: SENTRY_DB_NAME
          value: {{ default "sentry" .Values.postgresql.postgresqlDatabase | quote }}
        - name: SENTRY_DB_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.postgresql.existingSecret }}
              name: {{ .Values.postgresql.existingSecret }}
            {{- else }}
              name: {{ template "sentry.postgresql.secret" . }}
            {{- end }}
              key: {{ template "sentry.postgresql.secretKey" . }}
        - name: SENTRY_POSTGRES_HOST
          value: {{ template "sentry.postgresql.host" . }}
        - name: SENTRY_POSTGRES_PORT
          value: {{ template "sentry.postgresql.port" . }}
        {{- if or (.Values.redis.enabled) (.Values.redis.password) (.Values.redis.existingSecret)  }}
        - name: SENTRY_REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.redis.existingSecret }}
              name: {{ .Values.redis.existingSecret }}
            {{- else }}
              name: {{ template "sentry.redis.secret" . }}
            {{- end }}
              key: {{ template "sentry.redis.secretKey" . }}
        {{- end }}
        - name: SENTRY_REDIS_HOST
          value: {{ template "sentry.redis.host" . }}
        - name: SENTRY_REDIS_PORT
          value: {{ template "sentry.redis.port" . }}
        - name: SENTRY_EMAIL_HOST
          value: {{ default "" .Values.email.host | quote }}
        - name: SENTRY_EMAIL_PORT
          value: {{ default "" .Values.email.port | quote }}
        - name: SENTRY_EMAIL_USER
          value: {{ default "" .Values.email.user | quote }}
        - name: SENTRY_EMAIL_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.email.existingSecret }}
              name: {{ .Values.email.existingSecret }}
              key: {{ default "smtp-password" .Values.email.existingSecretKey }}
            {{- else }}
              name: {{ template "sentry.fullname" . }}
              key: smtp-password
            {{- end }}
        - name: SENTRY_EMAIL_USE_TLS
          value: {{ .Values.email.use_tls | quote }}
        - name: SENTRY_SERVER_EMAIL
          value: {{ .Values.email.from_address | quote }}
{{- if .Values.cron.env }}
{{ toYaml .Values.cron.env | indent 8 }}
{{- end }}
        volumeMounts:
        - mountPath: /etc/sentry
          name: config
          readOnly: true
        - mountPath: {{ .Values.filestore.filesystem.path }}
          name: sentry-data
        resources:
{{ toYaml .Values.cron.resources | indent 12 }}
      volumes:
      - name: config
        configMap:
          name: {{ template "sentry.fullname" . }}
      - name: sentry-data
      {{- if and (.Values.filestore.filesystem.persistence.enabled) (.Values.filestore.filesystem.persistence.persistentWorkers) }}
        persistentVolumeClaim:
          claimName: {{ .Values.filestore.filesystem.persistence.existingClaim | default (include "sentry.fullname" .) }}
      {{- else }}
        emptyDir: {}
      {{ end }}
      {{- if .Values.cron.priorityClassName }}
      priorityClassName: "{{ .Values.cron.priorityClassName }}"
      {{- end }}
 # db-init.job.yaml
# https://docs.sentry.io/server/installation/docker/#running-migrations
{{- if .Values.hooks.dbInit.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: "{{ .Release.Name }}-db-init"
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
  annotations:
    # This is what defines this resource as a hook. Without this line, the
    # job is considered part of the release.
    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-delete-policy": "hook-succeeded,before-hook-creation"
    "helm.sh/hook-weight": "-5"
spec:
  template:
    metadata:
      name: "{{ .Release.Name }}-db-init"
      annotations:
        checksum/secrets.yaml: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
      labels:
        app: {{ template "sentry.fullname" . }}
        release: "{{ .Release.Name }}"
        {{- if .Values.worker.podLabels }}
{{ toYaml .Values.worker.podLabels | indent 8 }}
        {{- end }}
    spec:
      {{- with .Values.hooks.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
      {{- end }}
      {{- if .Values.hooks.tolerations }}
      tolerations:
{{ toYaml .Values.hooks.tolerations | indent 8 }}
      {{- end }}
      restartPolicy: Never
      {{- if .Values.image.imagePullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.image.imagePullSecrets | indent 8 }}
      {{- end }}
      containers:
      - name: db-init-job
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        command: ["sentry","upgrade","--noinput"]
        env:
        - name: SENTRY_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: {{ template "sentry.fullname" . }}
              key: sentry-secret
        - name: SENTRY_DB_USER
          value: {{ default "sentry" .Values.postgresql.postgresqlUsername | quote }}
        - name: SENTRY_DB_NAME
          value: {{ default "sentry" .Values.postgresql.postgresqlDatabase | quote }}
        - name: SENTRY_DB_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.postgresql.existingSecret }}
              name: {{ .Values.postgresql.existingSecret }}
            {{- else }}
              name: {{ template "sentry.postgresql.secret" . }}
            {{- end }}
              key: {{ template "sentry.postgresql.secretKey" . }}
        - name: SENTRY_POSTGRES_HOST
          value: {{ template "sentry.postgresql.host" . }}
        - name: SENTRY_POSTGRES_PORT
          value: {{ template "sentry.postgresql.port" . }}
        {{- if or (.Values.redis.enabled) (.Values.redis.password) (.Values.redis.existingSecret)  }}
        - name: SENTRY_REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.redis.existingSecret }}
              name: {{ .Values.redis.existingSecret }}
            {{- else }}
              name: {{ template "sentry.redis.secret" . }}
            {{- end }}
              key: {{ template "sentry.redis.secretKey" . }}
        {{- end }}
        - name: SENTRY_REDIS_HOST
          value: {{ template "sentry.redis.host" . }}
        - name: SENTRY_REDIS_PORT
          value: {{ template "sentry.redis.port" . }}
        - name: SENTRY_EMAIL_HOST
          value: {{ default "" .Values.email.host | quote }}
        - name: SENTRY_EMAIL_PORT
          value: {{ default "" .Values.email.port | quote }}
        - name: SENTRY_EMAIL_USER
          value: {{ default "" .Values.email.user | quote }}
        - name: SENTRY_EMAIL_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.email.existingSecret }}
              name: {{ .Values.email.existingSecret }}
            {{- else }}
              name: {{ template "sentry.fullname" . }}
            {{- end }}
              key: smtp-password
        - name: SENTRY_EMAIL_USE_TLS
          value: {{ .Values.email.use_tls | quote }}
        - name: SENTRY_SERVER_EMAIL
          value: {{ .Values.email.from_address | quote }}
        volumeMounts:
        - mountPath: /etc/sentry
          name: config
          readOnly: true
        resources:
{{ toYaml .Values.hooks.dbInit.resources | indent 10 }}
      volumes:
      - name: config
        configMap:
          name: {{ template "sentry.fullname" . }}
{{- end -}}
 # ingress.yaml
{{- if .Values.ingress.enabled -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
 name: {{ template "sentry.fullname" . }}
 labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
  {{- with .Values.ingress.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
 annotations:
   {{- range $key, $value := .Values.ingress.annotations }}
     {{ $key }}: {{ $value | quote }}
   {{- end }}
spec:
  rules:
    - host: {{ .Values.ingress.hostname }}
      http:
        paths:
          {{- range .Values.ingress.extraPaths }}
          - path: {{ .path | quote }}
            backend:
              serviceName: {{ .backend.serviceName }}
              servicePort: {{ .backend.servicePort}}
          {{- end }}
          - path: {{ default "/" .Values.ingress.path | quote }}
            backend:
              serviceName: {{ template "sentry.fullname" . }}
              servicePort: {{ .Values.service.externalPort }}
{{- if .Values.ingress.tls }}
  tls:
{{ toYaml .Values.ingress.tls | indent 4 }}
{{- end -}}
{{- end -}}
 # metrics-deployment.yaml
{{- if .Values.metrics.enabled }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "sentry.fullname" . }}-metrics
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  selector:
    matchLabels:
        app: {{ template "sentry.fullname" . }}
        release: "{{ .Release.Name }}"
        role: metrics
  template:
    metadata:
      labels:
        app: {{ template "sentry.fullname" . }}
        release: "{{ .Release.Name }}"
        role: metrics
    spec:
      {{- if .Values.metrics.affinity }}
      affinity:
{{ toYaml .Values.metrics.affinity | indent 8 }}
      {{- end }}
      {{- if .Values.metrics.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.metrics.nodeSelector | indent 8 }}
      {{- end }}
      {{- if .Values.metrics.tolerations }}
      tolerations:
{{ toYaml .Values.metrics.tolerations | indent 8 }}
      {{- end }}
      {{- if .Values.metrics.schedulerName }}
      schedulerName: "{{ .Values.metrics.schedulerName }}"
      {{- end }}
      containers:
      - name: {{ .Chart.Name }}-metrics
        args: 
          - "--statsd.listen-udp=:9125"
          - "--web.listen-address=:9102"
        image: "{{ .Values.metrics.image.repository }}:{{ .Values.metrics.image.tag }}"
        imagePullPolicy: {{ .Values.metrics.image.pullPolicy }}
        ports:
        - name: statsd
          containerPort: 9125
        - name: metrics
          containerPort: 9102
{{- if .Values.metrics.livenessProbe.enabled }}
        livenessProbe:
          httpGet:
            path: /metrics
            port: 9102
            scheme: HTTP
          initialDelaySeconds: {{ .Values.metrics.livenessProbe.initialDelaySeconds }}
          periodSeconds: {{ .Values.metrics.livenessProbe.periodSeconds }}
          timeoutSeconds: {{ .Values.metrics.livenessProbe.timeoutSeconds }}
          successThreshold: {{ .Values.metrics.livenessProbe.successThreshold }}
          failureThreshold: {{ .Values.metrics.livenessProbe.failureThreshold }}
{{- end }}
{{- if .Values.metrics.readinessProbe.enabled }}
        readinessProbe:
          httpGet:
            path: /metrics
            port: 9102
            scheme: HTTP
          initialDelaySeconds: {{ .Values.metrics.readinessProbe.initialDelaySeconds }}
          periodSeconds: {{ .Values.metrics.readinessProbe.periodSeconds }}
          timeoutSeconds: {{ .Values.metrics.readinessProbe.timeoutSeconds }}
          successThreshold: {{ .Values.metrics.readinessProbe.successThreshold }}
          failureThreshold: {{ .Values.metrics.readinessProbe.failureThreshold }}
{{- end }}
        resources:
{{ toYaml .Values.metrics.resources | indent 10 }}
{{- end }}  # metrics-prometheus.yaml
{{- if and (.Values.metrics.enabled) (.Values.metrics.serviceMonitor.enabled) }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: {{ template "sentry.fullname" . }}
  {{- if .Values.metrics.serviceMonitor.namespace }}
  namespace: {{ .Values.metrics.serviceMonitor.namespace }}
  {{- end }}
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    {{- range $key, $value := .Values.metrics.serviceMonitor.selector }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
spec:
  endpoints:
  - port: metrics
    {{- if .Values.metrics.serviceMonitor.interval }}
    interval: {{ .Values.metrics.serviceMonitor.interval }}
    {{- end }}
  selector:
    matchLabels:
      app: {{ template "sentry.fullname" . }}
      release: {{ .Release.Name }}
  namespaceSelector:
    matchNames:
    - {{ .Release.Namespace }}
{{- end -}}
 # metrics-service.yaml
{{- if .Values.metrics.enabled }}
apiVersion: v1
kind: Service
metadata:
  name: {{ template "sentry.fullname" . }}-metrics
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
{{- if .Values.metrics.service.labels }}
{{ toYaml .Values.metrics.service.labels | indent 4 }}
{{- end }}
spec:
  type: {{ .Values.metrics.service.type }}
  ports:
  - port: 9102
    targetPort: 9102
    protocol: TCP
    name: metrics
  - port: 9125
    targetPort: 9125
    protocol: UDP
    name: statsd
  selector:
    app: {{ template "sentry.fullname" . }}
    release: {{ .Release.Name }}
    role: metrics
{{- end }}  # pvc.yaml
{{- if and .Values.filestore.filesystem.persistence.enabled (not .Values.filestore.filesystem.persistence.existingClaim) -}}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: {{ template "sentry.fullname" . }}
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  accessModes:
    - {{ .Values.filestore.filesystem.persistence.accessMode | quote }}
  resources:
    requests:
      storage: {{ .Values.filestore.filesystem.persistence.size | quote }}
{{- if .Values.filestore.filesystem.persistence.storageClass }}
{{- if (eq "-" .Values.filestore.filesystem.persistence.storageClass) }}
  storageClassName: ""
{{- else }}
  storageClassName: "{{ .Values.filestore.filesystem.persistence.storageClass }}"
{{- end }}
{{- end }}
{{- end -}}
 # secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "sentry.fullname" . }}
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
type: Opaque
data:
  {{ if .Values.sentrySecret }}
  sentry-secret: {{ .Values.sentrySecret | b64enc | quote }}
  {{ else }}
  sentry-secret: {{ randAlphaNum 40 | b64enc | quote }}
  {{ end }}
  {{- if not .Values.email.existingSecret }}
  smtp-password: {{ default "" .Values.email.password | b64enc | quote }}
  {{ end }}
  {{ if .Values.user.password }}
  user-password: {{ .Values.user.password | b64enc | quote }}
  {{ else }}
  user-password: {{ randAlphaNum 16 | b64enc | quote }}
  {{ end }}
  {{ if or (not .Values.postgresql.enabled) (.Values.postgresql.password) }}
  postgresql-password: {{ .Values.postgresql.postgresqlPassword | default "" | b64enc | quote }}
  {{ end }}
  {{ if and (not .Values.redis.enabled) (.Values.redis.password) }}
  redis-password: {{ .Values.redis.password | default "" | b64enc | quote }}
  {{ end }}
  {{- if and (eq .Values.filestore.backend "s3") (not .Values.filestore.s3.existingSecret) }}
  AWS_ACCESS_KEY_ID: {{ .Values.filestore.s3.accessKey | default "" | b64enc | quote }}
  AWS_SECRET_ACCESS_KEY: {{ .Values.filestore.s3.secretKey | default "" | b64enc | quote }}
  {{- end }}
 # serviceaccount.yaml
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "sentry.serviceAccountName" . }}
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
  {{- if .Values.serviceAccount.annotations }}
  annotations: {{ toYaml .Values.serviceAccount.annotations | nindent 4 }}
  {{- end }}
{{- end -}}
 # user-create.job.yaml
{{- if .Values.user.create -}}
apiVersion: batch/v1
kind: Job
metadata:
  name: "{{ .Release.Name }}-user-create"
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
  annotations:
    # This is what defines this resource as a hook. Without this line, the
    # job is considered part of the release.
    "helm.sh/hook": post-install
    "helm.sh/hook-delete-policy": "hook-succeeded,before-hook-creation"
    "helm.sh/hook-weight": "5"
spec:
  template:
    metadata:
      name: "{{ .Release.Name }}-user-create"
      annotations:
        checksum/secrets.yaml: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
      labels:
        app: {{ template "sentry.fullname" . }}
        release: "{{ .Release.Name }}"
        {{- if .Values.worker.podLabels }}
{{ toYaml .Values.worker.podLabels | indent 8 }}
        {{- end }}
    spec:
      {{- with .Values.hooks.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
      {{- end }}
      {{- if .Values.hooks.tolerations }}
      tolerations:
{{ toYaml .Values.hooks.tolerations | indent 8 }}
      {{- end }}
      restartPolicy: Never
      {{- if .Values.image.imagePullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.image.imagePullSecrets | indent 8 }}
      {{- end }}
      containers:
      - name: user-create-job
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        command: ["/bin/bash"]
        args:
          - "-c"
          - "export output=$(sentry createuser --no-input --email {{ .Values.user.email }} --superuser --password $SENTRY_USER_PASSWORD) || if echo $output | grep -q 'already exists'; then exit 0; else exit 1; fi"
        env:
        - name: SENTRY_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: {{ template "sentry.fullname" . }}
              key: sentry-secret
        - name: SENTRY_DB_USER
          value: {{ default "sentry" .Values.postgresql.postgresqlUsername | quote }}
        - name: SENTRY_DB_NAME
          value: {{ default "sentry" .Values.postgresql.postgresqlDatabase | quote }}
        - name: SENTRY_DB_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.postgresql.existingSecret }}
              name: {{ .Values.postgresql.existingSecret }}
            {{- else }}
              name: {{ template "sentry.postgresql.secret" . }}
            {{- end }}
              key: {{ template "sentry.postgresql.secretKey" . }}
        - name: SENTRY_POSTGRES_HOST
          value: {{ template "sentry.postgresql.host" . }}
        - name: SENTRY_POSTGRES_PORT
          value: {{ template "sentry.postgresql.port" . }}
        {{- if or (.Values.redis.enabled) (.Values.redis.password) (.Values.redis.existingSecret)  }}
        - name: SENTRY_REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.redis.existingSecret }}
              name: {{ .Values.redis.existingSecret }}
            {{- else }}
              name: {{ template "sentry.redis.secret" . }}
            {{- end }}
              key: {{ template "sentry.redis.secretKey" . }}
        {{- end }}
        - name: SENTRY_REDIS_HOST
          value: {{ template "sentry.redis.host" . }}
        - name: SENTRY_REDIS_PORT
          value: {{ template "sentry.redis.port" . }}
        - name: SENTRY_EMAIL_HOST
          value: {{ default "" .Values.smtpHost | quote }}
        - name: SENTRY_EMAIL_PORT
          value: {{ default "" .Values.smtpPort | quote }}
        - name: SENTRY_EMAIL_USER
          value: {{ default "" .Values.smtpUser | quote }}
        - name: SENTRY_EMAIL_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.email.existingSecret }}
              name: {{ .Values.email.existingSecret }}
            {{- else }}
              name: {{ template "sentry.fullname" . }}
            {{- end }}
              key: smtp-password
        - name: SENTRY_USER_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ template "sentry.fullname" . }}
              key: user-password
        - name: SENTRY_EMAIL_USE_TLS
          value: {{ .Values.email.use_tls | quote }}
        - name: SENTRY_SERVER_EMAIL
          value: {{ .Values.email.from_address | quote }}
        volumeMounts:
        - mountPath: /etc/sentry
          name: config
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: {{ template "sentry.fullname" . }}
{{- end -}}
 # web-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "sentry.fullname" . }}-web
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  selector:
    matchLabels:
        app: {{ template "sentry.fullname" . }}
        release: "{{ .Release.Name }}"
        role: web
  replicas: {{ .Values.web.replicacount }}
  template:
    metadata:
      annotations:
        metrics-enabled: {{ .Values.metrics.enabled | quote }}
        checksum/configYml: {{ .Values.config.configYml | sha256sum }}
        checksum/sentryConfPy: {{ .Values.config.sentryConfPy | sha256sum }}
        checksum/secrets.yaml: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
      {{- if .Values.web.podAnnotations }}
{{ toYaml .Values.web.podAnnotations | indent 8 }}
      {{- end }}
      labels:
        app: {{ template "sentry.fullname" . }}
        release: "{{ .Release.Name }}"
        role: web
        {{- if .Values.web.podLabels }}
{{ toYaml .Values.web.podLabels | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: {{ template "sentry.serviceAccountName" . }}
      {{- if .Values.web.affinity }}
      affinity:
{{ toYaml .Values.web.affinity | indent 8 }}
      {{- end }}
      {{- if .Values.web.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.web.nodeSelector | indent 8 }}
      {{- end }}
      {{- if .Values.web.tolerations }}
      tolerations:
{{ toYaml .Values.web.tolerations | indent 8 }}
      {{- end }}
      {{- if .Values.web.schedulerName }}
      schedulerName: "{{ .Values.web.schedulerName }}"
      {{- end }}
      {{- if .Values.image.imagePullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.image.imagePullSecrets | indent 8 }}
      {{- end }}
      containers:
      - name: {{ .Chart.Name }}-web
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        ports:
        - containerPort: {{ .Values.service.internalPort }}
        env:
        - name: SENTRY_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: {{ template "sentry.fullname" . }}
              key: sentry-secret
        - name: SENTRY_DB_USER
          value: {{ default "sentry" .Values.postgresql.postgresqlUsername | quote }}
        - name: SENTRY_DB_NAME
          value: {{ default "sentry" .Values.postgresql.postgresqlDatabase | quote }}
        - name: SENTRY_DB_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.postgresql.existingSecret }}
              name: {{ .Values.postgresql.existingSecret }}
            {{- else }}
              name: {{ template "sentry.postgresql.secret" . }}
            {{- end }}
              key: {{ template "sentry.postgresql.secretKey" . }}
        - name: SENTRY_POSTGRES_HOST
          value: {{ template "sentry.postgresql.host" . }}
        - name: SENTRY_POSTGRES_PORT
          value: {{ template "sentry.postgresql.port" . }}
        {{- if or (.Values.redis.enabled) (.Values.redis.password) (.Values.redis.existingSecret)  }}
        - name: SENTRY_REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.redis.existingSecret }}
              name: {{ .Values.redis.existingSecret }}
            {{- else }}
              name: {{ template "sentry.redis.secret" . }}
            {{- end }}
              key: {{ template "sentry.redis.secretKey" . }}
        {{- end }}
        - name: SENTRY_REDIS_HOST
          value: {{ template "sentry.redis.host" . }}
        - name: SENTRY_REDIS_PORT
          value: {{ template "sentry.redis.port" . }}
        - name: SENTRY_EMAIL_HOST
          value: {{ default "" .Values.email.host | quote }}
        - name: SENTRY_EMAIL_PORT
          value: {{ default "" .Values.email.port | quote }}
        - name: SENTRY_EMAIL_USER
          value: {{ default "" .Values.email.user | quote }}
        - name: SENTRY_EMAIL_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.email.existingSecret }}
              name: {{ .Values.email.existingSecret }}
            {{- else }}
              name: {{ template "sentry.fullname" . }}
            {{- end }}
              key: smtp-password
        - name: SENTRY_EMAIL_USE_TLS
          value: {{ .Values.email.use_tls | quote }}
        - name: SENTRY_SERVER_EMAIL
          value: {{ .Values.email.from_address | quote }}
        {{ if eq .Values.filestore.backend "gcs" }}
        - name: GOOGLE_APPLICATION_CREDENTIALS
          value: /var/run/secrets/google/{{ .Values.filestore.gcs.credentialsFile }}
        {{ end }}
        {{- if eq .Values.filestore.backend "s3" }}
        - name: AWS_ACCESS_KEY_ID
          valueFrom:
            secretKeyRef:
            {{- if .Values.filestore.s3.existingSecret }}
              name: {{ .Values.filestore.s3.existingSecret }}
            {{- else }}
              name: {{ template "sentry.fullname" . }}
            {{- end }}
              key: AWS_ACCESS_KEY_ID
        - name: AWS_SECRET_ACCESS_KEY
          valueFrom:
            secretKeyRef:
            {{- if .Values.filestore.s3.existingSecret }}
              name: {{ .Values.filestore.s3.existingSecret }}
            {{- else }}
              name: {{ template "sentry.fullname" . }}
            {{- end }}
              key: AWS_SECRET_ACCESS_KEY
        {{- end }}
{{- if .Values.web.env }}
{{ toYaml .Values.web.env | indent 8 }}
{{- end }}
        volumeMounts:
        - mountPath: /etc/sentry
          name: config
          readOnly: true
        - mountPath: {{ .Values.filestore.filesystem.path }}
          name: sentry-data
        {{- if eq .Values.filestore.backend "gcs" }}
        - name: sentry-google-cloud-key
          mountPath: /var/run/secrets/google
        {{ end }}
        livenessProbe:
          failureThreshold: {{ .Values.web.livenessProbe.failureThreshold }}
          httpGet:
            path: /_health/
            port: {{ .Values.service.internalPort }}
            scheme: HTTP
          initialDelaySeconds: {{ .Values.web.livenessProbe.initialDelaySeconds }}
          periodSeconds: {{ .Values.web.livenessProbe.periodSeconds }}
          successThreshold: {{ .Values.web.livenessProbe.successThreshold }}
          timeoutSeconds: {{ .Values.web.livenessProbe.timeoutSeconds }}
        readinessProbe:
          failureThreshold: {{ .Values.web.readinessProbe.failureThreshold }}
          httpGet:
            path: /_health/
            port: {{ .Values.service.internalPort }}
            scheme: HTTP
          initialDelaySeconds: {{ .Values.web.readinessProbe.initialDelaySeconds }}
          periodSeconds: {{ .Values.web.readinessProbe.periodSeconds }}
          successThreshold: {{ .Values.web.readinessProbe.successThreshold }}
          timeoutSeconds: {{ .Values.web.readinessProbe.timeoutSeconds }}
        resources:
{{ toYaml .Values.web.resources | indent 12 }}
      volumes:
      - name: config
        configMap:
          name: {{ template "sentry.fullname" . }}
      - name: sentry-data
      {{- if and (eq .Values.filestore.backend "filesystem") .Values.filestore.filesystem.persistence.enabled }}
        persistentVolumeClaim:
          claimName: {{ .Values.filestore.filesystem.persistence.existingClaim | default (include "sentry.fullname" .) }}
      {{- else }}
        emptyDir: {}
      {{ end }}
      {{- if eq .Values.filestore.backend "gcs" }}
      - name: sentry-google-cloud-key
        secret:
          secretName: {{ .Values.filestore.gcs.secretName }}
      {{ end }}
      {{- if .Values.web.priorityClassName }}
      priorityClassName: "{{ .Values.web.priorityClassName }}"
      {{- end }}
 # web-hpa.yaml
{{- if .Values.web.hpa.enabled -}}
apiVersion: autoscaling/v1
kind: HorizontalPodAutoscaler
metadata:
  name: {{ template "sentry.fullname" . }}-web
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  scaleTargetRef:
    kind: Deployment
    apiVersion: apps/v1
    name: {{ template "sentry.fullname" . }}-web
  minReplicas: {{ .Values.web.hpa.minpods }}
  maxReplicas: {{ .Values.web.hpa.maxpods }}
  targetCPUUtilizationPercentage: {{ .Values.web.hpa.cputhreshold }}
{{- end }}
 # web-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: {{ template "sentry.fullname" . }}
  annotations:
   {{- range $key, $value := .Values.service.annotations }}
     {{ $key }}: {{ $value | quote }}
   {{- end }}
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
{{- if .Values.service.annotations }}
  annotations:
{{ toYaml .Values.service.annotations | indent 4 }}
{{- end }}
spec:
  type: {{ .Values.service.type }}
  ports:
  - port: {{ .Values.service.externalPort }}
    targetPort: {{ .Values.service.internalPort }}
    protocol: TCP
    name: {{ .Values.service.name }}
{{- if and (.Values.service.nodePort) (eq .Values.service.type "NodePort") }}
    nodePort: {{ .Values.service.nodePort }}
{{- end }}
{{- if .Values.service.externalIPs }}
  externalIPs:
{{ toYaml .Values.service.externalIPs | indent 4 }}
{{- end }}
  selector:
    app: {{ template "sentry.fullname" . }}
    role: web
  {{- with .Values.service.loadBalancerSourceRanges }}
  loadBalancerSourceRanges:
    {{- toYaml . | nindent 4 }}
  {{- end }}
 # worker-hpa.yaml
{{- if .Values.worker.hpa.enabled -}}
apiVersion: autoscaling/v1
kind: HorizontalPodAutoscaler
metadata:
  name: {{ template "sentry.fullname" . }}-worker
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  scaleTargetRef:
    kind: Deployment
    apiVersion: apps/v1
    name: {{ template "sentry.fullname" . }}-worker
  minReplicas: {{ .Values.worker.hpa.minpods }}
  maxReplicas: {{ .Values.worker.hpa.maxpods }}
  targetCPUUtilizationPercentage: {{ .Values.worker.hpa.cputhreshold }}
{{- end }}
 # workers-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "sentry.fullname" . }}-worker
  labels:
    app: {{ template "sentry.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  selector:
    matchLabels:
        app: {{ template "sentry.fullname" . }}
        release: "{{ .Release.Name }}"
        role: worker
  replicas: {{ .Values.worker.replicacount }}
  template:
    metadata:
      annotations:
        metrics-enabled: {{ .Values.metrics.enabled | quote }}
        checksum/configYml: {{ .Values.config.configYml | sha256sum }}
        checksum/sentryConfPy: {{ .Values.config.sentryConfPy | sha256sum }}
        checksum/secrets.yaml: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
      {{- if .Values.worker.podAnnotations }}
{{ toYaml .Values.worker.podAnnotations | indent 8 }}
      {{- end }}
      labels:
        app: {{ template "sentry.fullname" . }}
        release: "{{ .Release.Name }}"
        role: worker
        {{- if .Values.worker.podLabels }}
{{ toYaml .Values.worker.podLabels | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: {{ template "sentry.serviceAccountName" . }}
      {{- if .Values.worker.affinity }}
      affinity:
{{ toYaml .Values.worker.affinity | indent 8 }}
      {{- end }}
      {{- if .Values.worker.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.worker.nodeSelector | indent 8 }}
      {{- end }}
      {{- if .Values.worker.tolerations }}
      tolerations:
{{ toYaml .Values.worker.tolerations | indent 8 }}
      {{- end }}
      {{- if .Values.worker.schedulerName }}
      schedulerName: "{{ .Values.worker.schedulerName }}"
      {{- end }}
      {{- if .Values.worker.priorityClassName }}
      priorityClassName: "{{ .Values.worker.priorityClassName }}"
      {{- end }}
      {{- if .Values.image.imagePullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.image.imagePullSecrets | indent 8 }}
      {{- end }}
      containers:
      - name: {{ .Chart.Name }}-workers
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        args:
          - "run"
          - "worker"
          {{- if .Values.worker.concurrency }}
          - "-c"
          - "{{ .Values.worker.concurrency }}"
          {{- end }}
        ports:
        - containerPort: {{ .Values.service.internalPort }}
        env:
        - name: SENTRY_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: {{ template "sentry.fullname" . }}
              key: sentry-secret
        - name: SENTRY_DB_USER
          value: {{ default "sentry" .Values.postgresql.postgresqlUsername | quote }}
        - name: SENTRY_DB_NAME
          value: {{ default "sentry" .Values.postgresql.postgresqlDatabase | quote }}
        - name: SENTRY_DB_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.postgresql.existingSecret }}
              name: {{ .Values.postgresql.existingSecret }}
            {{- else }}
              name: {{ template "sentry.postgresql.secret" . }}
            {{- end }}
              key: {{ template "sentry.postgresql.secretKey" . }}
        - name: SENTRY_POSTGRES_HOST
          value: {{ template "sentry.postgresql.host" . }}
        - name: SENTRY_POSTGRES_PORT
          value: {{ template "sentry.postgresql.port" . }}
        {{- if or (.Values.redis.enabled) (.Values.redis.password) (.Values.redis.existingSecret)  }}
        - name: SENTRY_REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.redis.existingSecret }}
              name: {{ .Values.redis.existingSecret }}
            {{- else }}
              name: {{ template "sentry.redis.secret" . }}
            {{- end }}
              key: {{ template "sentry.redis.secretKey" . }}
        {{- end }}
        - name: SENTRY_REDIS_HOST
          value: {{ template "sentry.redis.host" . }}
        - name: SENTRY_REDIS_PORT
          value: {{ template "sentry.redis.port" . }}
        - name: SENTRY_EMAIL_HOST
          value: {{ default "" .Values.email.host | quote }}
        - name: SENTRY_EMAIL_PORT
          value: {{ default "" .Values.email.port | quote }}
        - name: SENTRY_EMAIL_USER
          value: {{ default "" .Values.email.user | quote }}
        - name: SENTRY_EMAIL_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.email.existingSecret }}
              name: {{ .Values.email.existingSecret }}
            {{- else }}
              name: {{ template "sentry.fullname" . }}
            {{- end }}
              key: smtp-password
        - name: SENTRY_EMAIL_USE_TLS
          value: {{ .Values.email.use_tls | quote }}
        - name: SENTRY_SERVER_EMAIL
          value: {{ .Values.email.from_address | quote }}
        {{ if eq .Values.filestore.backend "gcs" }}
        - name: GOOGLE_APPLICATION_CREDENTIALS
          value: /var/run/secrets/google/{{ .Values.filestore.gcs.credentialsFile }}
        {{ end }}
        {{- if eq .Values.filestore.backend "s3" }}
        - name: AWS_ACCESS_KEY_ID
          valueFrom:
            secretKeyRef:
            {{- if .Values.filestore.s3.existingSecret }}
              name: {{ .Values.filestore.s3.existingSecret }}
            {{- else }}
              name: {{ template "sentry.fullname" . }}
            {{- end }}
              key: AWS_ACCESS_KEY_ID
        - name: AWS_SECRET_ACCESS_KEY
          valueFrom:
            secretKeyRef:
            {{- if .Values.filestore.s3.existingSecret }}
              name: {{ .Values.filestore.s3.existingSecret }}
            {{- else }}
              name: {{ template "sentry.fullname" . }}
            {{- end }}
              key: AWS_SECRET_ACCESS_KEY
        {{- end }}
{{- if .Values.worker.env }}
{{ toYaml .Values.worker.env | indent 8 }}
{{- end }}
        volumeMounts:
        - mountPath: /etc/sentry
          name: config
          readOnly: true
        {{- if eq .Values.filestore.backend "gcs" }}
        - name: sentry-google-cloud-key
          mountPath: /var/run/secrets/google
        {{- end }}
        {{- if eq .Values.filestore.backend "filesystem" }}
        - mountPath: {{ .Values.filestore.filesystem.path }}
          name: sentry-data
        {{- end }}
        resources:
{{ toYaml .Values.worker.resources | indent 12 }}
      volumes:
      - name: config
        configMap:
          name: {{ template "sentry.fullname" . }}
      {{- if eq .Values.filestore.backend "gcs" }}
      - name: sentry-google-cloud-key
        secret:
          secretName: {{ .Values.filestore.gcs.secretName }}
      {{ end }}
      - name: sentry-data
      {{- if and (.Values.filestore.filesystem.persistence.enabled) (.Values.filestore.filesystem.persistence.persistentWorkers) }}
        persistentVolumeClaim:
          claimName: {{ .Values.filestore.filesystem.persistence.existingClaim | default (include "sentry.fullname" .) }}
      {{- else }}
        emptyDir: {}
      {{ end }}

# Default values for sentry.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
image:
  repository: sentry
  tag: "9.1.2"
  pullPolicy: IfNotPresent
  # Add the secret name to pull from a private registry.
  imagePullSecrets: []
  # - name:

# How many web UI instances to run
web:
  hpa:
    enabled: false
    cputhreshold: 60
    minpods: 1
    maxpods: 10
  replicacount: 1
  resources: {}
    # limits:
    #   cpu: 500m
    #   memory: 500Mi
    # requests:
    #   cpu: 300m
    #   memory: 300Mi
  env:
    - name: GITHUB_APP_ID
      value:
    - name: GITHUB_API_SECRET
      value:
  nodeSelector: {}
  tolerations: []
  affinity: {}
  livenessProbe:
    failureThreshold: 5
    initialDelaySeconds: 50
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 2
  readinessProbe:
    failureThreshold: 10
    initialDelaySeconds: 50
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 2
  # priorityClassName: ""
  ## Use an alternate scheduler, e.g. "stork".
  ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
  ##
  # schedulerName:
  # Optional extra labels for pod, i.e. redis-client: "true"
  # podLabels: []


# How many cron instances to run
cron:
  replicacount: 1
  resources: {}
    # limits:
    #   cpu: 200m
    #   memory: 200Mi
    # requests:
    #   cpu: 100m
    #   memory: 100Mi
  nodeSelector: {}
  tolerations: []
  affinity: {}
  # priorityClassName: ""
  # schedulerName:
  # Optional extra labels for pod, i.e. redis-client: "true"
  # podLabels: []

# How many worker instances to run
worker:
  hpa:
    enabled: false
    cputhreshold: 60
    minpods: 1
    maxpods: 10
  replicacount: 2
  resources: {}
    # limits:
    #   cpu: 300m
    #   memory: 500Mi
    # requests:
    #   cpu: 100m
    #   memory: 100Mi
  nodeSelector: {}
  tolerations: []
  affinity: {}
  # priorityClassName: ""
  # schedulerName:
  # Optional extra labels for pod, i.e. redis-client: "true"
  # podLabels: []
  # concurrency:

# Admin user to create
user:
  # Indicated to create the admin user or not,
  # Default is true as the initial installation.
  create: true
  email: admin@sentry.local
  # password: admin-password

# BYO Email server
# TODO: Add exim4 template
# https://docs.sentry.io/server/installation/docker/#outbound-email
email:
  from_address: sentry@sentry.local
  host: smtp
  port: 25
  use_tls: false
  user:
  password:
  enable_replies: false
  # When defined the `password` field is ignored
  # existingSecret: secret-name
  # existingSecretKey: smtp-password

# Name of the service and what port to expose on the pod
# Don't change these unless you know what you're doing
service:
  name: sentry
  type: LoadBalancer
  externalPort: 9000
  internalPort: 9000

  ## Service annotations
  ##
  annotations: {}

  ## External IP addresses of service
  ## Default: nil
  ##
  # externalIPs:
  # - 192.168.0.1

  ## Load Balancer allow-list
  # loadBalancerSourceRanges: []

# Configure the location of Sentry artifacts
filestore:
  # Set to one of filesystem, gcs or s3 as supported by Sentry.
  backend: filesystem

  filesystem:
    path: /var/lib/sentry/files

    ## Enable persistence using Persistent Volume Claims
    ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
    ##
    persistence:
      enabled: true
      ## database data Persistent Volume Storage Class
      ## If defined, storageClassName: <storageClass>
      ## If set to "-", storageClassName: "", which disables dynamic provisioning
      ## If undefined (the default) or set to null, no storageClassName spec is
      ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
      ##   GKE, AWS & OpenStack)
      ##
      # storageClass: "-"
      accessMode: ReadWriteOnce
      size: 10Gi

      ## Whether to mount the persistent volume to the Sentry worker and
      ## cron deployments. This setting needs to be enabled for some advanced
      ## Sentry features, such as private source maps. If you disable this
      ## setting, the Sentry workers will not have access to artifacts you upload
      ## through the web deployment.
      ## Please note that you may need to change your accessMode to ReadWriteMany
      ## if you plan on having the web, worker and cron deployments run on
      ## different nodes.
      persistentWorkers: false

  ## Point this at a pre-configured secret containing a service account. The resulting
  ## secret will be mounted at /var/run/secrets/google
  gcs:
    credentialsFile: credentials.json
  #  secretName:
  #  bucketName:

  ## Currently unconfigured and changing this has no impact on the template configuration.
  s3: {}
  #  accessKey:
  #  secretKey:
  #  bucketName:
  #  endpointUrl:
  #  signature_version:
  #  region_name:
  #  default_acl:

## Configure ingress resource that allow you to access the
## Sentry installation. Set up the URL
## ref: http://kubernetes.io/docs/user-guide/ingress/
##
ingress:
  enabled: false
  hostname: sentry.local

  ## Extra paths to prepend to every host configuration. This is useful when configuring custom actions with
  ## [AWS ALB Ingress Controller](https://kubernetes-sigs.github.io/aws-alb-ingress-controller/guide/ingress/annotation/#actions).
  extraPaths: []
    # - path: /*
    #   backend:
    #     serviceName: ssl-redirect
    #     servicePort: use-annotation

  ## Ingress annotations
  ##
  annotations: {}
  #   kubernetes.io/ingress.class: nginx
  #   kubernetes.io/tls-acme: 'true'

  ## Ingress labels
  #
  labels: {}
  #   env: dev

  ## Ingress TLS configuration
  ## Secrets must be manually created in the namespace
  ##
  tls: []
  #   - secretName: sentry.local-tls
  #     hosts:
  #       - sentry.local

# TODO: add support for plugins https://docs.sentry.io/server/plugins/

postgresql:
  enabled: true
  nameOverride: sentry-postgresql
  postgresqlDatabase: sentry
  postgresqlUsername: postgres
  # The following variables are only used when internal PG is disabled
  # postgresqlHost: postgres
  # postgresqlPassword: postgres
  # postgresqlPort: 5432
  # When defined the `postgresqlPassword` field is ignored
  # existingSecret: secret-name
  # existingSecretKey: postgresql-password

redis:
  enabled: true
  nameOverride: sentry-redis
  # The following variables are only used when internal PG is disabled
  # host: redis
  # Just omit the password field if your redis cluster doesn't use password
  # password: redis
  # port: 6379
  # When defined the `password` field is ignored
  # existingSecret: secret-name
  # existingSecretKey: redis-password
  master:
    persistence:
      enabled: true
      # If change pvc size redis.master.persistence.size: 20Gi

config:
  configYml: ""
  sentryConfPy: ""

## Prometheus Exporter / Metrics
##
metrics:
  enabled: false

  ## Configure extra options for liveness and readiness probes
  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
  livenessProbe:
    enabled: true
    initialDelaySeconds: 30
    periodSeconds: 5
    timeoutSeconds: 2
    failureThreshold: 3
    successThreshold: 1
  readinessProbe:
    enabled: true
    initialDelaySeconds: 30
    periodSeconds: 5
    timeoutSeconds: 2
    failureThreshold: 3
    successThreshold: 1

  ## Metrics exporter resource requests and limits
  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
  resources: {}
  #   limits:
  #     cpu: 100m
  #     memory: 100Mi
  #   requests:
  #     cpu: 100m
  #     memory: 100Mi

  nodeSelector: {}
  tolerations: []
  affinity: {}
  # schedulerName:
  # Optional extra labels for pod, i.e. redis-client: "true"
  # podLabels: []
  service:
    type: ClusterIP
    labels: {}

  image:
    repository: prom/statsd-exporter
    tag: v0.10.5
    pullPolicy: IfNotPresent

  # Enable this if you're using https://github.com/coreos/prometheus-operator
  serviceMonitor:
    enabled: false
    ## Specify a namespace if needed
    # namespace: monitoring
    # fallback to the prometheus default unless specified
    # interval: 10s
    ## Defaults to what's used if you follow CoreOS [Prometheus Install Instructions](https://github.com/helm/charts/tree/master/stable/prometheus-operator#tldr)
    ## [Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#prometheus-operator-1)
    ## [Kube Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#exporters)
    selector:
      prometheus: kube-prometheus

# Provide affinity for hooks if needed
hooks:
  affinity: {}
  tolerations: []
  dbInit:
    enabled: true
    resources:
    # We setup 3000Mi for the memory limit because of a Sentry instance need at least 3Gb RAM to perform a migration process
    # reference: https://github.com/helm/charts/issues/15296
      limits:
        memory: 3200Mi
      requests:
        memory: 3000Mi

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name:
  annotations: {}
