# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "aws-iam-authenticator.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "aws-iam-authenticator.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "aws-iam-authenticator.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Return the apiVersion of daemonset.
*/}}
{{- define "daemonset.apiVersion" -}}
{{- if .Capabilities.APIVersions.Has "apps/v1" -}}
    {{- print "apps/v1" -}}
{{- else -}}
    {{- print "extensions/v1beta1" -}}
{{- end -}}
{{- end -}}
 # configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "aws-iam-authenticator.fullname" . }}
  labels:
    app: {{ template "aws-iam-authenticator.name" . }}
    chart: {{ template "aws-iam-authenticator.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
data:
  config.yaml: |
{{ toYaml .Values.config | indent 4 }}
 # daemonset.yaml
apiVersion: {{ template "daemonset.apiVersion" . }}
kind: DaemonSet
metadata:
  name: {{ template "aws-iam-authenticator.fullname" . }}
  labels:
    app: {{ template "aws-iam-authenticator.name" . }}
    chart: {{ template "aws-iam-authenticator.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  selector:
    matchLabels:
      app: {{ template "aws-iam-authenticator.name" . }}
      release: {{ .Release.Name }}
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ""
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
      labels:
        app: {{ template "aws-iam-authenticator.name" . }}
        release: {{ .Release.Name }}
    spec:
      # run on the host network (don't depend on CNI)
      hostNetwork: true

      # run on each master node
      nodeSelector:
        node-role.kubernetes.io/master: ""
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
      - key: CriticalAddonsOnly
        operator: Exists

      # run `aws-iam-authenticator server` with three volumes
      # - config (mounted from the ConfigMap at /etc/aws-iam-authenticator/config.yaml)
      # - state (persisted TLS certificate and keys, mounted from the host)
      # - output (output kubeconfig to plug into your apiserver configuration, mounted from the host)
      containers:
      - name: {{ template "aws-iam-authenticator.fullname" . }}
        image: gcr.io/heptio-images/authenticator:v0.1.0
        args:
        - server
        - --config=/etc/aws-iam-authenticator/config.yaml
        - --state-dir=/var/aws-iam-authenticator
        - --generate-kubeconfig=/etc/kubernetes/aws-iam-authenticator/kubeconfig.yaml

        resources:
{{ toYaml .Values.resources | indent 10 }}

        volumeMounts:
        - name: config
          mountPath: /etc/aws-iam-authenticator/
        - name: state
          mountPath: /var/aws-iam-authenticator/
        - name: output
          mountPath: /etc/kubernetes/aws-iam-authenticator/

      volumes:
      - name: config
        configMap:
          name: {{ template "aws-iam-authenticator.fullname" . }}
      - name: output
        hostPath:
          path: {{ .Values.hostPathConfig.output }}
      - name: state
        hostPath:
          path: {{ .Values.hostPathConfig.state }}

image:
  repository: gcr.io/heptio-images/authenticator
  tag: v0.1.0
  pullPolicy: IfNotPresent

config: {}

resources: {}

hostPathConfig:
  output: /srv/kubernetes/aws-iam-authenticator/
  state: /srv/kubernetes/aws-iam-authenticator/
