# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "magic-namespace.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "magic-namespace.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "magic-namespace.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Allow a custom secretName to be defined
*/}}
{{- define "magic-namespace.tillerTlsSecret" -}}
{{- if .Values.tiller.tls.secretName -}}
{{- .Values.tiller.tls.secretName }}
{{- else -}}
{{- template "magic-namespace.fullname" . }}-tiller-secret
{{- end -}}
{{- end -}}
 # namespace.yaml
{{- if hasKey .Values "namespace" }}
apiVersion: v1
kind: Namespace
metadata:
  name: {{ .Values.namespace }}
  {{- if hasKey .Values "namespaceAttributes" }}
{{ toYaml .Values.namespaceAttributes | indent 2 }}
  {{ end -}}
{{- end }}
 # rolebindings.yaml
{{- $values := .Values }}
{{- range .Values.roleBindings }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ .name }}
  {{- if hasKey $values "namespace" }}
  namespace: {{ $values.namespace }}
  {{- end }}
  labels:
    chart: {{ template "magic-namespace.chart" $ }}
    release: {{ $.Release.Name }}
    heritage: {{ $.Release.Service }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: {{ .role.kind }}
  name: {{ .role.name }}
subjects:
- kind: {{ .subject.kind }}
  name: {{ .subject.name }}
{{- end }}
 # secret.yaml
{{- if (and (.Values.tiller.tls.enabled) (not .Values.tiller.tls.secretName)) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "magic-namespace.tillerTlsSecret" . }}
  {{- if hasKey .Values "namespace" }}
  namespace: {{ .Values.namespace }}
  {{- end }}
  labels:
    app: {{ template "magic-namespace.chart" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
type: Opaque
data:
  ca.crt: {{ required "You need to populate .Values.tiller.tls.ca with a Base64 encoded CA" .Values.tiller.tls.ca }}
  tls.crt: {{ required "You need to populate .Values.tiller.tls.cert with a Base64 encoded cert" .Values.tiller.tls.cert }}
  tls.key: {{ required "You need to populate .Values.tiller.tls.key with a Base64 encoded key" .Values.tiller.tls.key}}
{{- end }}
 # serviceaccounts.yaml
{{- $values := .Values }}
{{- range .Values.serviceAccounts }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ . }}
  {{- if hasKey $values "namespace" }}
  namespace: {{ $values.namespace }}
  {{- end }}
  labels:
    chart: {{ template "magic-namespace.chart" $ }}
    release: {{ $.Release.Name }}
    heritage: {{ $.Release.Service }}
{{- end }}
 # tiller-deployment.yaml
{{- if .Values.tiller.enabled }}
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: tiller-deploy
  {{- if hasKey .Values "namespace" }}
  namespace: {{ .Values.namespace }}
  {{- end }}
  labels:
    app: helm
    name: tiller
    chart: {{ template "magic-namespace.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  replicas: {{ .Values.tiller.replicaCount }}
  selector:
    matchLabels:
      app: helm
      name: tiller
      release: {{ .Release.Name }}
  template:
    metadata:
      labels:
        app: helm
        name: tiller
        chart: {{ template "magic-namespace.chart" . }}
        release: {{ .Release.Name }}
        heritage: {{ .Release.Service }}
    spec:
      serviceAccountName: tiller
      containers:
        - name: tiller
          image: "{{ .Values.tiller.image.repository }}:{{ .Values.tiller.image.tag }}"
          imagePullPolicy: {{ .Values.tiller.image.pullPolicy }}
          env:
          - name: TILLER_NAMESPACE
            {{- if hasKey .Values "namespace" }}
            value: {{ .Values.namespace }}
            {{- else }}
            value: {{ .Release.Namespace }}
            {{- end }}
          - name: TILLER_HISTORY_MAX
            value: {{ quote .Values.tiller.maxHistory }}
          {{- if .Values.tiller.tls.enabled }}
          - name: TILLER_TLS_ENABLE
            value: "1"
          {{- if .Values.tiller.tls.verify }}
          - name: TILLER_TLS_VERIFY
            value: "1"
          {{- end }}
          - name: TILLER_TLS_CERTS
            value: /etc/certs
          {{- end }}
          {{- if .Values.tiller.onlyListenOnLocalhost }}
          command:
            - "/tiller"
          {{- if .Values.tiller.storage }}
            - --storage={{ .Values.tiller.storage }}
          {{- end }}
          args: ["--listen=127.0.0.1:44134"]
          {{- else }}
          ports:
          - containerPort: 44134
            name: tiller
            protocol: TCP
          - containerPort: 44135
            name: http
            protocol: TCP
          {{- end }}
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /liveness
              port: 44135
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /readiness
              port: 44135
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
          {{- if .Values.tiller.tls.enabled }}
          - mountPath: /etc/certs
            name: tiller-certs
            readOnly: true
          {{- end }}
          resources:
{{ toYaml .Values.tiller.resources | indent 12 }}
      volumes:
      {{- if .Values.tiller.tls.enabled }}
      - name: tiller-certs
        secret:
          defaultMode: 0644
          secretName: {{ template "magic-namespace.tillerTlsSecret" . }}
      {{- end }}
    {{- with .Values.tiller.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.tiller.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.tiller.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
    {{- end }}
{{- end }}
 # tiller-rolebinding.yaml
{{- if .Values.tiller.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tiller-{{ .Values.tiller.role.name }}
  {{- if hasKey .Values "namespace" }}
  namespace: {{ .Values.namespace }}
  {{- end }}
  labels:
    app: helm
    name: tiller
    chart: {{ template "magic-namespace.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: {{ .Values.tiller.role.type }}
  name: {{ .Values.tiller.role.name }}
subjects:
- kind: ServiceAccount
  name: tiller
  {{- if hasKey .Values "namespace" }}
  namespace: {{ .Values.namespace }}
  {{- else }}
  namespace: {{ .Release.Namespace }}
  {{- end }}

{{- end }}
 # tiller-service.yaml
{{- if and .Values.tiller.enabled .Values.tiller.includeService }}
apiVersion: v1
kind: Service
metadata:
  name: tiller-deploy
  {{- if hasKey .Values "namespace" }}
  namespace: {{ .Values.namespace }}
  {{- end }}
  labels:
    app: helm
    name: tiller
    chart: {{ template "magic-namespace.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  type: ClusterIP
  selector:
    app: helm
    name: tiller
  ports:
  - name: tiller
    port: 44134
    protocol: TCP
    targetPort: tiller
{{- end }}
 # tiller-serviceaccount.yaml
{{- if .Values.tiller.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tiller
  {{- if hasKey .Values "namespace" }}
  namespace: {{ .Values.namespace }}
  {{- end }}
  labels:
    app: helm
    name: tiller
    chart: {{ template "magic-namespace.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
{{- end }}

## Default values for magic-namespace

# Uncomment and set to override the namespace that will be created.
# namespace: default

# Extra namespace attributes
# namespaceAttributes:
  # Labels to be added to the namespace definition
  # labels: {}

  # Annotations to be added to the namespace definition
  # annotations: {}

tiller:
  enabled: true

  replicaCount: 1

  image:
    repository: gcr.io/kubernetes-helm/tiller
    tag: v2.8.1
    pullPolicy: IfNotPresent

  maxHistory: 0

  ## Storage driver to use. One of 'configmap', 'memory', or 'secret'
  storage: configmap

  tls:
    ## Enable TLS encryption between Helm and Tiller
    enabled: false

    ## Verify remote certificate
    verify: true

    ## A custom secret to mount instead of specifying Base64 Values below
    secretName: ""

    ## Specify a Base64 encoded CA
    # ca: "Zm9vCg=="

    ## Specify a Base64 encoded cert
    # cert: "Zm9vCg=="

    ## Specify a Base64 encoded private key
    # key: "Zm9vCg=="

  ## The following options specify the Role or ClusterRole to assign to the
  ## tiller service account. The ClusterRole "admin" is usually pre-defined in
  ## RBAC-enabled clusters and will allow administration of a namespace by
  ## whatever users or ServiceAccounts are bound to it in that same namespace.
  ## THERE IS SELDOM ANY REASON TO OVERRIDE THIS!!!
  role:
    ## Valid values are "Role" or "ClusterRole"
    type: ClusterRole
    name: admin

  ## Security options. The default values close known attack vectors.
  ## ALTER THESE AT YOUR OWN RISK!!!!

  ## Note that these tight restrictions do NOT impede normal use of Helm. Helm
  ## is always usable with any Tiller as long as the Helm user has permission to
  ## tunnel into pods in that Tiller's namespace.
  ## (Helm does this automatically.)

  ## Specify whether to include a service of type ClusterIP for Tiller
  includeService: false

  ## Specify whether Tiller pods should listen to 0.0.0.0 or just localhost
  onlyListenOnLocalhost: true

  ## We usually recommend not to specify default resources and to leave this as a conscious
  ## choice for the user. This also increases chances charts run on environments with little
  ## resources, such as Minikube. If you do want to specify resources, uncomment the following
  ## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  resources: {}
    # limits:
    #  cpu: 100m
    #  memory: 128Mi
    # requests:
    #  cpu: 100m
    #  memory: 128Mi

  nodeSelector: {}

  tolerations: []

  affinity: {}

## Optional additional ServiceAccounts
serviceAccounts: []
# - some-service-account
# - another-service-account

## Optional additional RoleBindings. It is a good idea to specify at least one
## to grant administrative permissions to a user or group.
# roleBindings:
# - name: admin-group-admin
#   role:
#     ## Valid values are "Role" or "ClusterRole"
#     kind: ClusterRole
#     name: admin
#   subject:
#     ## Valid values are "User", "Group", or "ServiceAccount"
#     kind: Group
#     name: <group>
