# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "etcd.fullname" -}}
{{- printf "%s-%s" .Release.Name "etcd" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
 # etcd_deployment.yaml
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: etcd
  labels:
    app: {{ template "etcd.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    suite: {{ template "fullname" . }}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: {{ template "etcd.fullname" . }}
      suite: {{ template "fullname" . }}
  template:
    metadata:
      name: etcd
      labels:
        app: {{ template "etcd.fullname" . }}
        suite: {{ template "fullname" . }}
    spec:
      volumes:
        - name: etcdvol
        {{- if .Values.etcd.persistence.enabled }}
          persistentVolumeClaim:
            claimName: {{ template "etcd.fullname" . }}-pvc
        {{- else }}
          hostPath:
           path: "/var/pachyderm/etcd"
        {{- end }}
      containers:
        - name: etcd
          image: '{{ .Values.etcd.image.repository }}:{{ .Values.etcd.image.tag }}'
          command:
          - "/usr/local/bin/etcd"
          - "--listen-client-urls=http://0.0.0.0:2379"
          - "--advertise-client-urls=http://0.0.0.0:2379"
          - "--data-dir=/var/data/etcd"
          - "--auto-compaction-retention=1"
          - "--max-txn-ops=5000"
          ports:
            - name: client-port
              containerPort: 2379
            - name: peer-port
              containerPort: 2380
          resources:
           requests:
            cpu: '{{ .Values.etcd.resources.requests.cpu }}'
            memory: {{ .Values.etcd.resources.requests.memory }}
          {{- if .Values.etcd.resources.limits }}
           limits:
            cpu: '{{ .Values.etcd.resources.limits.cpu }}'
            memory: {{ .Values.etcd.resources.limits.memory }}
          {{- end }}
          volumeMounts:
            - name: etcdvol
              mountPath: "/var/data/etcd"
          imagePullPolicy: {{ .Values.etcd.image.pullPolicy }}
 # etcd_pvc.yaml
---
{{- if .Values.etcd.persistence.enabled }}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: {{ template "etcd.fullname" . }}-pvc
spec:
  accessModes:
    - {{ .Values.etcd.persistence.accessMode | quote }}
  resources:
    requests:
      storage: {{ .Values.etcd.persistence.size | quote }}
{{- if .Values.etcd.persistence.storageClass }}
{{- if (eq "-" .Values.etcd.persistence.storageClass) }}
  storageClassName: ""
{{- else }}
  storageClassName: "{{ .Values.etcd.persistence.storageClass }}"
{{- end }}
{{- end }}
{{- end }}
 # etcd_svc.yaml
---
kind: Service
apiVersion: v1
metadata:
  name: etcd
  labels:
    app: {{ template "etcd.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    suite: {{ template "fullname" . }}
spec:
  ports:
    - name: client-port
      port: 2379
      targetPort: 0
  selector:
    app: {{ template "etcd.fullname" . }}
  type: NodePort
 # pachd_cluster_role.yaml
---
{{- if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: {{ template "fullname" . }}
  creationTimestamp:
  labels:
    app: ''
    suite: {{ template "fullname" . }}
rules:
- verbs:
  - get
  - list
  - watch
  apiGroups:
  - ''
  resources:
  - nodes
  - pods
  - pods/log
  - endpoints
- verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
  apiGroups:
  - ''
  resources:
  - replicationcontrollers
  - services
- verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
  apiGroups:
  - ''
  resources:
  - secrets
  resourceNames:
  - pachyderm-storage-secret
{{- end }}
 # pachd_deployment.yaml
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: pachd
  labels:
    app: pachd
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    suite: {{ template "fullname" . }}
spec:
  replicas: {{ .Values.pachd.replicaCount }}
  selector:
    matchLabels:
      app: pachd
      suite: {{ template "fullname" . }}
  template:
    metadata:
      name: pachd
      annotations:
        {{- if .Values.amazon.roleArn }}
        iam.amazonaws.com/role: {{ .Values.amazon.roleArn }}
        {{- end }}
      labels:
        app: pachd
        suite: {{ template "fullname" . }}
    spec:
      volumes:
      - name: pachdvol
        {{- if eq .Values.credentials "local" }}
        hostPath:
         path: "/var/pachyderm/pachd"
        {{- end }}
      - name: pachyderm-storage-secret
        secret:
          secretName: pachyderm-storage-secret
      containers:
      - name: pachd
        image: '{{ .Values.pachd.image.repository }}:{{ .Values.pachd.image.tag }}'
        ports:
        - name: api-grpc-port
          containerPort: 650
          protocol: TCP
        - name: trace-port
          containerPort: 651
        - name: api-http-port
          containerPort: 652
        env:
        - name: EXPOSE_OBJECT_API
          value: {{ .Values.pachd.exposeObjApi | quote }}
        - name: PACH_ROOT
          value: "/pach"
        - name: NUM_SHARDS
          value: '16'
        - name: STORAGE_BACKEND
          {{- if eq .Values.credentials "s3" }}
          value: MINIO
          {{- else if eq .Values.credentials "google" }}
          value: GOOGLE
          {{- else if eq .Values.credentials "amazon" }}
          value: AMAZON
          {{- else if eq .Values.credentials "microsoft" }}
          value: MICROSOFT
          {{- else if eq .Values.credentials "local" }}
          value: LOCAL
          {{- end }}
        - name: STORAGE_HOST_PATH
          {{- if eq .Values.credentials "local" }}
          value: "/var/pachyderm/pachd"
          {{- end }}
        - name: GOOGLE_BUCKET
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: google-bucket
              optional: true
        - name: GOOGLE_CRED
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: google-cred
              optional: true
        - name: AMAZON_BUCKET
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: amazon-bucket
              optional: true
        - name: AMAZON_DISTRIBUTION
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: amazon-distribution
              optional: true
        - name: AMAZON_ID
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: amazon-id
              optional: true
        - name: AMAZON_SECRET
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: amazon-secret
              optional: true
        - name: AMAZON_REGION
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: amazon-region
              optional: true
        - name: AMAZON_TOKEN
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: amazon-token
              optional: true
        - name: MICROSOFT_CONTAINER
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: microsoft-container
              optional: true
        - name: MICROSOFT_ID
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: microsoft-id
              optional: true
        - name: MICROSOFT_SECRET
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: microsoft-secret
              optional: true
        - name: MINIO_ENDPOINT
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: minio-endpoint
              optional: true
        - name: MINIO_BUCKET
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: minio-bucket
              optional: true
        - name: MINIO_SECURE
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: minio-secure
              optional: true
        - name: MINIO_ID
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: minio-id
              optional: true
        - name: MINIO_SECRET
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: minio-secret
              optional: true
        - name: MINIO_SIGNATURE
          valueFrom:
            secretKeyRef:
              name: pachyderm-storage-secret
              key: minio-signature
              optional: true
        - name: PACHD_POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: WORKER_IMAGE
          value: '{{ .Values.pachd.worker.repository }}:{{ .Values.pachd.worker.tag }}'
        - name: WORKER_SIDECAR_IMAGE
          value: '{{ .Values.pachd.image.repository }}:{{ .Values.pachd.image.tag }}'
        - name: WORKER_IMAGE_PULL_POLICY
          value: IfNotPresent
        - name: PACHD_VERSION
          value: {{ .Values.pachd.image.tag }}
        - name: METRICS
          value: 'true'
        - name: LOG_LEVEL
          value: info
        - name: BLOCK_CACHE_BYTES
          value: '{{ .Values.pachd.pfsCache }}'
        {{- if eq .Values.credentials "amazon" }}
        - name: IAM_ROLE
          value: {{ .Values.amazon.roleArn }}
        {{- end }}
        - name: PACHYDERM_AUTHENTICATION_DISABLED_FOR_TESTING
          value: 'false'
        resources:
          requests:
            cpu: '{{ .Values.pachd.resources.requests.cpu }}'
            memory: {{ .Values.pachd.resources.requests.memory }}
        {{- if .Values.pachd.resources.limits }}
          limits:
            cpu: '{{ .Values.pachd.resources.limits.cpu }}'
            memory: {{ .Values.pachd.resources.limits.memory }}
        {{- end }}
        volumeMounts:
        - name: pachdvol
          mountPath: "/pach"
        - name: pachyderm-storage-secret
          mountPath: "/pachyderm-storage-secret"
        imagePullPolicy: {{ .Values.pachd.image.pullPolicy }}
        securityContext:
          privileged: true
      serviceAccountName: {{ template "fullname" . }}
  strategy: {}
status: {}
 # pachd_rolebinding.yaml
---
{{- if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: {{ template "fullname" . }}
roleRef:
  apiGroup: ''
  kind: ClusterRole
  name: {{ template "fullname" . }}
subjects:
  - kind: ServiceAccount
    name: {{ template "fullname" . }}
    namespace: {{ .Release.Namespace }}
{{- end }}
 # pachd_sa.yaml
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: {{ template "fullname" . }}
  labels:
    app: {{ template "fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    suite: {{ template "fullname" . }}
 # pachd_secret.yaml
---
apiVersion: v1
kind: Secret
metadata:
  name: pachyderm-storage-secret
  labels:
    app: {{ template "fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    suite: {{ template "fullname" . }}
data:
  {{- if eq .Values.credentials "s3" }}
  minio-id: {{ .Values.s3.accessKey | b64enc | quote }}
  minio-secret: {{ .Values.s3.secretKey | b64enc | quote  }}
  minio-bucket: {{ .Values.s3.bucketName | b64enc | quote }}
  minio-endpoint: {{ .Values.s3.endpoint | b64enc | quote }}
  minio-secure: {{ toString .Values.s3.secure | b64enc | quote }}
  minio-signature: {{ toString .Values.s3.signature | b64enc | quote }}
  {{- else if eq .Values.credentials "google" }}
  google-bucket: {{ .Values.google.bucketName | b64enc | quote }}
  google-cred: {{ .Values.google.credentials | b64enc | quote }}
  {{- else if eq .Values.credentials "amazon" }}
  amazon-bucket: {{ .Values.amazon.bucketName | b64enc | quote }}
  {{- if .Values.amazon.distribution }}
  amazon-distribution: {{ .Values.amazon.distribution | b64enc | quote }}
  {{- end }}
  {{- if .Values.amazon.id }}
  amazon-id: {{ .Values.amazon.id | b64enc | quote }}
  {{- end }}
  amazon-region: {{ .Values.amazon.region | b64enc | quote }}
  {{- if not .Values.amazon.roleArn }}
  amazon-secret: {{ .Values.amazon.secret | b64enc | quote }}
  amazon-token: {{ .Values.amazon.token | b64enc | quote }}
  {{- end }}
  {{- else if eq .Values.credentials "microsoft" }}
  microsoft-container: {{ .Values.microsoft.container | b64enc | quote }}
  microsoft-id: {{ .Values.microsoft.id | b64enc | quote }}
  microsoft-secret: {{ .Values.microsoft.secret | b64enc | quote }}
  {{- end }}
 # pachd_svc.yaml
---
kind: Service
apiVersion: v1
metadata:
  name: pachd-api-grpc
  {{- if .Values.pachd.service.grpc.annotations }}
  annotations:
    {{ .Values.pachd.service.grpc.annotations | toYaml | indent 4 | trim  }}
  {{- end }}
  labels:
    app: pachd
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    suite: {{ template "fullname" . }}
spec:
  ports:
    - name: api-grpc-port
      port: {{ .Values.pachd.service.grpc.port }}
      targetPort: 650
      {{- if eq .Values.pachd.service.grpc.type "NodePort" }}
      nodePort: {{ .Values.pachd.service.grpc.port }}
      {{- end }}
  selector:
    app: pachd
  type: {{ .Values.pachd.service.grpc.type | quote }}

---
kind: Service
apiVersion: v1
metadata:
  name: pachd-trace
  labels:
    app: pachd
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    suite: {{ template "fullname" . }}
spec:
  ports:
    - name: trace-port
      port: 651
      targetPort: 651
      nodePort: 30651
  selector:
    app: pachd
  type: "NodePort"

---
kind: Service
apiVersion: v1
metadata:
  name: pachd-api-http
  labels:
    app: pachd
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    suite: {{ template "fullname" . }}
spec:
  ports:
    - name: api-http-port
      port: 652
      targetPort: 652
      nodePort: 30652
  selector:
    app: pachd
  type: "NodePort"

---
rbac:
 # Specifies whether RBAC resources should be created
 create: true

## Set default credentials for object store
credentials: "local"

## S3 endpoint (i.e: Minio server) credentials
s3:
 accessKey: ""
 secretKey: ""
 bucketName: ""
 ## The endpoint should be something like: <mydomain>.<subdomain>:<port>
 endpoint: ""
 ## For 'true' set the value to 1
 secure: "0"
 ## For 'S3v2' signature, set the value to 1. For 'S3v4', set this value to 0
 signature: "1"

## Google Cloud credentials
google:
 bucketName: ""
 credentials: ""

## Amazon Web Services credentials
amazon:
 bucketName: ""
 ## The distribution parameter is often an empty string
 distribution: ""
 id: ""
 region: ""
 roleArn: ""
 secret: ""
 token: ""

## Microsoft Azure credentials
microsoft:
 container: ""
 id: ""
 secret: ""

## Set default image settings, resource requests and number of replicas of pachd
pachd:
 exposeObjApi: false
 replicaCount: 1
 ## Size of pachd's in-memory cache for PFS files. Size is specified in bytes, with allowed SI suffixes (M, K, G, Mi, Ki, Gi, etc).
 pfsCache: 0G
 ## For available images please check: https://hub.docker.com/r/pachyderm/pachd/tags/
 image:
  repository: pachyderm/pachd
  tag: 1.8.6
  pullPolicy: Always
 worker:
  repository: pachyderm/worker
  tag: 1.8.6
 resources:
  ## For non-local deployments, 1 cpu and 2G of memory requests are recommended
  requests:
   cpu: 250m
   memory: 512M
  # limits:
  #  cpu: 250m
  #  memory: 512M
 service:
  grpc:
   annotations: {}
   port: 30650
   type: NodePort

## Set default image settings and persistence settings of etcd
etcd:
 ## For available images please check: https://hub.docker.com/r/pachyderm/etcd/tags or: https://quay.io/repository/coreos/etcd?tag=latest&tab=tags
 image:
  repository: quay.io/coreos/etcd
  tag: v3.3.5
  pullPolicy: IfNotPresent
  ## Enable persistence using Persistent Volume Claims
  ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
 persistence:
  enabled: false
  ## etcd data Persistent Volume Storage Class
  ## If defined, storageClassName: <storageClass>
  ## If set to "-", storageClassName: "", which disables dynamic provisioning
  ## If undefined (the default) or set to null, no storageClassName spec is
  ## set, choosing the default provisioner. (gp2 on AWS, standard on
  ## GKE, AWS & OpenStack)
  # storageClass: "-"
  ## Set default PVC size
  size: 20G
  ## Set default PVC access mode: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes
  accessMode: ReadWriteOnce
 resources:
  ## For non-local deployments, 1 cpu and 2G of memory requests are recommended
  requests:
   cpu: 250m
   memory: 256M
  # limits:
  #  cpu: 250m
  #  memory: 512M
