# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "searchlight.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "searchlight.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s" $name .Release.Name | trunc 63 -}}
{{- end -}}
 # cluster-role-binding.yaml
{{ if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: {{ template "searchlight.fullname" . }}
  labels:
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app: "{{ template "searchlight.name" . }}"
    heritage: "{{ .Release.Service }}"
    release: "{{ .Release.Name }}"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template "searchlight.fullname" . }}
subjects:
- kind: ServiceAccount
  name: {{ template "searchlight.fullname" . }}
  namespace: {{ .Release.Namespace }}
{{ end }}
 # cluster-role.yaml
{{ if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: {{ template "searchlight.fullname" . }}
  labels:
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app: "{{ template "searchlight.name" . }}"
    heritage: "{{ .Release.Service }}"
    release: "{{ .Release.Name }}"
rules:
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - "*"
- apiGroups:
  - extensions
  resources:
  - thirdpartyresources
  verbs:
  - "*"
- apiGroups:
  - monitoring.appscode.com
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["storage.k8s.io"]
  resources: ["*"]
  verbs: ["get"]
- apiGroups: [""]
  resources:
  - secrets
  - componentStatuses
  - persistentVolumes
  - persistentVolumeClaims
  verbs: ["get"]
- apiGroups: [""]
  resources:
  - pods
  - nodes
  - namespaces
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources:
  - events
  verbs: ["create", "list"]
{{ end }}
 # deployment.yaml
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: {{ template "searchlight.fullname" . }}
  labels:
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app: "{{ template "searchlight.name" . }}"
    heritage: "{{ .Release.Service }}"
    release: "{{ .Release.Name }}"
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: "{{ template "searchlight.name" . }}"
        release: "{{ .Release.Name }}"
{{- if and .Values.criticalAddon (eq .Release.Namespace "kube-system") }}
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
{{- end }}
    spec:
      serviceAccountName: {{ if .Values.rbac.create }}{{ template "searchlight.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }}
      containers:
      - name: operator
        image: {{ .Values.operator.image }}:{{ .Values.operator.tag }}
        imagePullPolicy: {{ .Values.imagePullPolicy }}
        {{- if .Values.imagePullSecrets }}
        imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
        {{- end }}
        args:
        - run
        - --v={{ .Values.logLevel }}
        - --config-dir=/srv
        - --config-secret-name={{ template "searchlight.fullname" . }}
        - --api.address=:8080
        - --web.address=:56790
        ports:
        - name: api
          containerPort: 8080
          protocol: TCP
        - name: web
          containerPort: 56790
          protocol: TCP
        volumeMounts:
        - name: data
          mountPath: /srv
      - name: icinga
        image: {{ .Values.icinga.image }}:{{ .Values.icinga.tag }}
        imagePullPolicy: {{ .Values.imagePullPolicy }}
        {{- if .Values.imagePullSecrets }}
        imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
        {{- end }}
        ports:
        - name: icinga
          containerPort: 5665
          protocol: TCP
        - name: ui
          containerPort: 60006
          protocol: TCP
        livenessProbe:
          httpGet:
            scheme: HTTPS
            port: 5665
            path: /v1/status
            httpHeaders:
              - name: Authorization
                value: "Basic c3RhdHVzdXNlcjpzdGF0dXNwYXNz"
          initialDelaySeconds: 120
          periodSeconds: 30
        volumeMounts:
        - name: data
          mountPath: /srv
      - name: ido
        image: {{ .Values.ido.image }}:{{ .Values.ido.tag }}
        imagePullPolicy: {{ .Values.imagePullPolicy }}
        {{- if .Values.imagePullSecrets }}
        imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
        {{- end }}
        env:
        - name: PGDATA
          value: /var/lib/postgresql/data/pgdata
        ports:
        - name: ido
          containerPort: 5432
          protocol: TCP
        volumeMounts:
        - name: data
          mountPath: /var/lib/postgresql/data
      volumes:
      - name: data
        emptyDir: {}
{{- if and .Values.criticalAddon (eq .Release.Namespace "kube-system") }}
      tolerations:
      - key: "CriticalAddonsOnly"
        operator: "Exists"
{{- end -}}
{{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end -}}
 # secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "searchlight.fullname" . }}
  labels:
    app: "{{ template "searchlight.name" . }}"
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
data:
  {{- if .Values.icinga2web.password }}
  ICINGA_WEB_UI_PASSWORD: {{ .Values.icinga2web.password | b64enc | quote }}
  {{ else }}
  ICINGA_WEB_UI_PASSWORD: {{ randAlphaNum 10 | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.hipchat.authToken }}
  HIPCHAT_AUTH_TOKEN: {{ .Values.notifier.hipchat.authToken | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.mailgun.domain }}
  MAILGUN_DOMAIN: {{ .Values.notifier.mailgun.domain | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.mailgun.apiKey }}
  MAILGUN_API_KEY: {{ .Values.notifier.mailgun.apiKey | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.mailgun.publicAPIKey }}
  MAILGUN_PUBLIC_API_KEY: {{ .Values.notifier.mailgun.publicAPIKey | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.mailgun.from }}
  MAILGUN_FROM: {{ .Values.notifier.mailgun.from | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.smtp.host }}
  SMTP_HOST: {{ .Values.notifier.smtp.host | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.smtp.port }}
  SMTP_PORT: {{ .Values.notifier.smtp.port | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.smtp.insecureSkipVerify }}
  SMTP_INSECURE_SKIP_VERIFY: {{ .Values.notifier.smtp.insecureSkipVerify | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.smtp.username }}
  SMTP_USERNAME: {{ .Values.notifier.smtp.username | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.smtp.password }}
  SMTP_PASSWORD: {{ .Values.notifier.smtp.password | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.smtp.from }}
  SMTP_FROM: {{ .Values.notifier.smtp.from | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.twilio.accountSid }}
  TWILIO_ACCOUNT_SID: {{ .Values.notifier.twilio.accountSid | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.twilio.authToken }}
  TWILIO_AUTH_TOKEN: {{ .Values.notifier.twilio.authToken | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.twilio.from }}
  TWILIO_FROM: {{ .Values.notifier.twilio.from | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.slack.authToken }}
  SLACK_AUTH_TOKEN: {{ .Values.notifier.slack.authToken | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.slack.channel }}
  SLACK_CHANNEL:  {{ .Values.notifier.slack.channel | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.plivo.authId }}
  PLIVO_AUTH_ID: {{ .Values.notifier.plivo.authId | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.plivo.authToken }}
  PLIVO_AUTH_TOKEN: {{ .Values.notifier.plivo.authToken | b64enc | quote }}
  {{ end -}}
  {{- if .Values.notifier.plivo.from }}
  PLIVO_FROM: {{ .Values.notifier.plivo.from | b64enc | quote }}
  {{ end -}}
 # service-account.yaml
{{ if .Values.rbac.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "searchlight.fullname" . }}
  labels:
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app: "{{ template "searchlight.name" . }}"
    heritage: "{{ .Release.Service }}"
    release: "{{ .Release.Name }}"
{{ end }}
 # service.yaml
apiVersion: v1
kind: Service
metadata:
  name: {{ template "searchlight.fullname" . }}
  labels:
    app: "{{ template "searchlight.name" . }}"
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  ports:
  - name: ui
    port: 80
    targetPort: ui
  - name: icinga
    port: 5665
    targetPort: icinga
  - name: api
    port: 8080
    targetPort: api
  - name: web
    port: 56790
    targetPort: web
  selector:
    app: "{{ template "searchlight.name" . }}"
    release: "{{ .Release.Name }}"

# Default values for searchlight.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

operator:
  image: appscode/searchlight
  tag: 5.0.0

ido:
  image: appscode/postgres
  tag: 9.5-alpine

icinga:
  image: appscode/icinga
  tag: 5.0.0-k8s

## Optionally specify an array of imagePullSecrets.
## Secrets must be manually created in the namespace.
## ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
##
# imagePullSecrets:

#   - name: myRegistryKeySecretName
## Specify a imagePullPolicy
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
##
imagePullPolicy: IfNotPresent

## Node labels for pod assignment
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
##
nodeSelector: {}

## Log level for proxy
logLevel: 3

## Icinga configaration
## https://github.com/appscode/searchlight/blob/master/docs/icinga2/deployment.md#create-deployment
icinga2web:
  password: changeit

notifier:
  hipchat:
    authToken: ''
  mailgun:
    domain: ''
    apiKey: ''
    publicAPIKey: ''
    from: ''
  smtp:
    host: ''
    port: ''
    insecureSkipVerify: ''
    username: ''
    password: ''
    from: ''
  twilio:
    accountSid: ''
    authToken: ''
    from: ''
  slack:
    authToken: ''
    channel: ''
  plivo:
    authId: ''
    authToken: ''
    from: ''

## Installs Searchlight operator as critical addon
## https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/
criticalAddon: false

## Install Default RBAC roles and bindings
rbac:
  ## If true, create & use RBAC resources
  create: false
  ## Ignored if rbac.create is true
  serviceAccountName: default
