# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "nfs-client-provisioner.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "nfs-client-provisioner.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "nfs-client-provisioner.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{- define "nfs-client-provisioner.provisionerName" -}}
{{- if .Values.storageClass.provisionerName -}}
{{- printf .Values.storageClass.provisionerName -}}
{{- else -}}
cluster.local/{{ template "nfs-client-provisioner.fullname" . -}}
{{- end -}}
{{- end -}}

{{/*
Create the name of the service account to use
*/}}
{{- define "nfs-client-provisioner.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
    {{ default (include "nfs-client-provisioner.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
    {{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}

{{/*
Return the appropriate apiVersion for podSecurityPolicy.
*/}}
{{- define "podSecurityPolicy.apiVersion" -}}
{{- if semverCompare ">=1.10-0" .Capabilities.KubeVersion.GitVersion -}}
{{- print "policy/v1beta1" -}}
{{- else -}}
{{- print "extensions/v1beta1" -}}
{{- end -}}
{{- end -}} # clusterrole.yaml
{{- if .Values.rbac.create }}
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    app: {{ template "nfs-client-provisioner.name" . }}
    chart: {{ template "nfs-client-provisioner.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
  name: {{ template "nfs-client-provisioner.fullname" . }}-runner
rules:
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "update", "patch"]
{{- if .Values.podSecurityPolicy.enabled }}
  - apiGroups:      ['extensions']
    resources:      ['podsecuritypolicies']
    verbs:          ['use']
    resourceNames:  [{{ template "nfs-client-provisioner.fullname" . }}]
{{- end }}
{{- end }}
 # clusterrolebinding.yaml
{{- if .Values.rbac.create }}
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    app: {{ template "nfs-client-provisioner.name" . }}
    chart: {{ template "nfs-client-provisioner.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
  name: run-{{ template "nfs-client-provisioner.fullname" . }}
subjects:
  - kind: ServiceAccount
    name: {{ template "nfs-client-provisioner.serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: {{ template "nfs-client-provisioner.fullname" . }}-runner
  apiGroup: rbac.authorization.k8s.io
{{- end }}
 # deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "nfs-client-provisioner.fullname" . }}
  labels:
    app: {{ template "nfs-client-provisioner.name" . }}
    chart: {{ template "nfs-client-provisioner.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
spec:
  replicas: {{ .Values.replicaCount }}
  strategy:
    type: {{ .Values.strategyType }}
  selector:
    matchLabels:
      app: {{ template "nfs-client-provisioner.name" . }}
      release: {{ .Release.Name }}
  template:
    metadata:
      annotations:
      {{- if and (.Values.tolerations) (semverCompare "<1.6-0" .Capabilities.KubeVersion.GitVersion) }}
        scheduler.alpha.kubernetes.io/tolerations: '{{ toJson .Values.tolerations }}'
      {{- end }}
      labels:
        app: {{ template "nfs-client-provisioner.name" . }}
        release: {{ .Release.Name }}
    spec:
      serviceAccountName: {{ template "nfs-client-provisioner.serviceAccountName" . }}
      {{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
      {{- end }}
      {{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
      {{- end }}
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName | quote }}
      {{- end }}
      {{- if .Values.imagePullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
      {{- end }}
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          volumeMounts:
            - name: nfs-client-root
              mountPath: /persistentvolumes
          env:
            - name: PROVISIONER_NAME
              value: {{ template "nfs-client-provisioner.provisionerName" . }}
            - name: NFS_SERVER
              value: {{ .Values.nfs.server }}
            - name: NFS_PATH
              value: {{ .Values.nfs.path }}
          {{- with .Values.resources }}
          resources:
{{ toYaml . | indent 12 }}
          {{- end }}
      volumes:
        - name: nfs-client-root
{{- if .Values.buildMode }}
          emptyDir: {}
{{- else if .Values.nfs.mountOptions }}
          persistentVolumeClaim:
            claimName: pvc-{{ template "nfs-client-provisioner.fullname" . }}
{{- else }}
          nfs:
            server: {{ .Values.nfs.server }}
            path: {{ .Values.nfs.path }}
{{- end }}
      {{- if and (.Values.tolerations) (semverCompare "^1.6-0" .Capabilities.KubeVersion.GitVersion) }}
      tolerations:
{{ toYaml .Values.tolerations | indent 6 }}
      {{- end }}
 # persistentvolume.yaml
{{ if .Values.nfs.mountOptions -}}
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-{{ template "nfs-client-provisioner.fullname" . }}
  labels: 
    nfs-client-provisioner: {{ template "nfs-client-provisioner.fullname" . }}
spec:
  capacity:
    storage: 10Mi
  volumeMode: Filesystem
  accessModes:
    - {{ .Values.storageClass.accessModes }}
  persistentVolumeReclaimPolicy: {{ .Values.storageClass.reclaimPolicy }}
  storageClassName: ""
  {{- if .Values.nfs.mountOptions }}
  mountOptions:
    {{- range .Values.nfs.mountOptions }}
    - {{ . }}
    {{- end }}
  {{- end }}
  nfs:
    server: {{ .Values.nfs.server }}
    path: {{ .Values.nfs.path }}
{{ end -}}
 # persistentvolumeclaim.yaml
{{ if .Values.nfs.mountOptions -}}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: pvc-{{ template "nfs-client-provisioner.fullname" . }}
spec:
  accessModes:
    - {{ .Values.storageClass.accessModes }}
  volumeMode: Filesystem
  storageClassName: ""
  selector:
    matchLabels:
      nfs-client-provisioner: {{ template "nfs-client-provisioner.fullname" . }}
  resources:
    requests:
      storage: 10Mi
{{ end -}}
 # podsecuritypolicy.yaml
{{- if .Values.podSecurityPolicy.enabled }}
apiVersion: {{ template "podSecurityPolicy.apiVersion" . }}
kind: PodSecurityPolicy
metadata:
  name: {{ template "nfs-client-provisioner.fullname" . }}
  labels:
    app: {{ template "nfs-client-provisioner.name" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'secret'
    - 'nfs'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'RunAsAny'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'
  readOnlyRootFilesystem: false
{{- end }}
 # role.yaml
{{- if .Values.rbac.create }}
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    app: {{ template "nfs-client-provisioner.name" . }}
    chart: {{ template "nfs-client-provisioner.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
  name: leader-locking-{{ template "nfs-client-provisioner.fullname" . }}
rules:
  - apiGroups: [""]
    resources: ["endpoints"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
{{- if .Values.podSecurityPolicy.enabled }}
  - apiGroups:      ['extensions']
    resources:      ['podsecuritypolicies']
    verbs:          ['use']
    resourceNames:  [{{ template "nfs-client-provisioner.fullname" . }}]
{{- end }}
{{- end }}
 # rolebinding.yaml
{{- if .Values.rbac.create }}
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    app: {{ template "nfs-client-provisioner.name" . }}
    chart: {{ template "nfs-client-provisioner.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
  name: leader-locking-{{ template "nfs-client-provisioner.fullname" . }}
subjects:
  - kind: ServiceAccount
    name: {{ template "nfs-client-provisioner.serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
roleRef:
  kind: Role
  name: leader-locking-{{ template "nfs-client-provisioner.fullname" . }}
  apiGroup: rbac.authorization.k8s.io
{{- end }}
 # serviceaccount.yaml
{{ if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: {{ template "nfs-client-provisioner.name" . }}
    chart: {{ template "nfs-client-provisioner.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
  name: {{ template "nfs-client-provisioner.serviceAccountName" . }}
{{- end -}}
 # storageclass.yaml
{{ if .Values.storageClass.create -}}
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  labels:
    app: {{ template "nfs-client-provisioner.name" . }}
    chart: {{ template "nfs-client-provisioner.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
  name: {{ .Values.storageClass.name }}
{{- if .Values.storageClass.defaultClass }}
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"
{{- end }}
provisioner: {{ template "nfs-client-provisioner.provisionerName" . }}
allowVolumeExpansion: {{ .Values.storageClass.allowVolumeExpansion }}
reclaimPolicy: {{ .Values.storageClass.reclaimPolicy }}
parameters:
  archiveOnDelete: "{{ .Values.storageClass.archiveOnDelete }}"
{{- if .Values.nfs.mountOptions }}
mountOptions:
  {{- range .Values.nfs.mountOptions }}
  - {{ . }}
  {{- end }}
{{- end }}
{{ end -}}

# Default values for nfs-client-provisioner.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 1
strategyType: Recreate

image:
  repository: quay.io/external_storage/nfs-client-provisioner
  tag: v3.1.0-k8s1.11
  pullPolicy: IfNotPresent

nfs:
  server:
  path: /ifs/kubernetes
  mountOptions:

# For creating the StorageClass automatically:
storageClass:
  create: true

  # Set a provisioner name. If unset, a name will be generated.
  # provisionerName:

  # Set StorageClass as the default StorageClass
  # Ignored if storageClass.create is false
  defaultClass: false

  # Set a StorageClass name
  # Ignored if storageClass.create is false
  name: nfs-client

  # Allow volume to be expanded dynamically
  allowVolumeExpansion: true

  # Method used to reclaim an obsoleted volume
  reclaimPolicy: Delete

  # When set to false your PVs will not be archived by the provisioner upon deletion of the PVC.
  archiveOnDelete: true

  # Set access mode - ReadWriteOnce, ReadOnlyMany or ReadWriteMany
  accessModes: ReadWriteOnce

## For RBAC support:
rbac:
  # Specifies whether RBAC resources should be created
  create: true

# If true, create & use Pod Security Policy resources
# https://kubernetes.io/docs/concepts/policy/pod-security-policy/
podSecurityPolicy:
  enabled: false

## Set pod priorityClassName
# priorityClassName: ""

serviceAccount:
  # Specifies whether a ServiceAccount should be created
  create: true

  # The name of the ServiceAccount to use.
  # If not set and create is true, a name is generated using the fullname template
  name:

resources: {}
  # limits:
  #  cpu: 100m
  #  memory: 128Mi
  # requests:
  #  cpu: 100m
  #  memory: 128Mi

nodeSelector: {}

tolerations: []

affinity: {}
