# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "minio.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "minio.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "minio.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Return the appropriate apiVersion for networkpolicy.
*/}}
{{- define "minio.networkPolicy.apiVersion" -}}
{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.GitVersion -}}
{{- print "extensions/v1beta1" -}}
{{- else if semverCompare "^1.7-0" .Capabilities.KubeVersion.GitVersion -}}
{{- print "networking.k8s.io/v1" -}}
{{- end -}}
{{- end -}}

{{/*
Return the appropriate apiVersion for deployment.
*/}}
{{- define "minio.deployment.apiVersion" -}}
{{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.GitVersion -}}
{{- print "apps/v1beta2" -}}
{{- else -}}
{{- print "apps/v1" -}}
{{- end -}}
{{- end -}}

{{/*
Return the appropriate apiVersion for statefulset.
*/}}
{{- define "minio.statefulset.apiVersion" -}}
{{- if .Capabilities.APIVersions.Has "apps/v1beta2" -}}
{{- print "apps/v1beta2" -}}
{{- else -}}
{{- print "apps/v1" -}}
{{- end -}}
{{- end -}}

{{/*
Return the appropriate apiVersion for ingress.
*/}}
{{- define "minio.ingress.apiVersion" -}}
{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}}
{{- print "extensions/v1beta1" -}}
{{- else -}}
{{- print "networking.k8s.io/v1beta1" -}}
{{- end -}}
{{- end -}}

{{/*
Determine service account name for deployment or statefulset.
*/}}
{{- define "minio.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
{{- default (include "minio.fullname" .) .Values.serviceAccount.name | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- default "default" .Values.serviceAccount.name -}}
{{- end -}}
{{- end -}}

{{/*
Properly format optional additional arguments to Minio binary
*/}}
{{- define "minio.extraArgs" -}}
{{- range .Values.extraArgs -}}
{{ " " }}{{ . }}
{{- end -}}
{{- end -}}

{{/*
Return the proper Docker Image Registry Secret Names
*/}}
{{- define "minio.imagePullSecrets" -}}
{{/*
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic.
Also, we can not use a single if because lazy evaluation is not an option
*/}}
{{- if .Values.global }}
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- else if .Values.imagePullSecrets }}
imagePullSecrets: 
    {{ toYaml .Values.imagePullSecrets }}
{{- end -}}
{{- else if .Values.imagePullSecrets }}
imagePullSecrets: 
    {{ toYaml .Values.imagePullSecrets }}
{{- end -}}
{{- end -}} # configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "minio.fullname" . }}
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
data:
  initialize: |-
{{ include (print $.Template.BasePath "/_helper_create_bucket.txt") . | indent 4 }}
 # deployment.yaml
{{- if eq .Values.mode "standalone" }}
{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }}
apiVersion: {{ template "minio.deployment.apiVersion" . }}
kind: Deployment
metadata:
  name: {{ template "minio.fullname" . }}
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  strategy:
    type: {{ .Values.DeploymentUpdate.type }}
    {{- if eq .Values.DeploymentUpdate.type "RollingUpdate" }}
    rollingUpdate:
      maxSurge: {{ .Values.DeploymentUpdate.maxSurge }}
      maxUnavailable: {{ .Values.DeploymentUpdate.maxUnavailable }}
    {{- end}}
  {{- if .Values.nasgateway.enabled }}
  replicas: {{ .Values.nasgateway.replicas }}
  {{- end }}
  {{- if .Values.s3gateway.enabled }}
  replicas: {{ .Values.s3gateway.replicas }}
  {{- end }}
  {{- if .Values.azuregateway.enabled }}
  replicas: {{ .Values.azuregateway.replicas }}
  {{- end }}
  {{- if .Values.gcsgateway.enabled }}
  replicas: {{ .Values.gcsgateway.replicas }}
  {{- end }}
  {{- if .Values.ossgateway.enabled }}
  replicas: {{ .Values.ossgateway.replicas }}
  {{- end }}
  {{- if .Values.b2gateway.enabled }}
  replicas: {{ .Values.b2gateway.replicas }}
  {{- end }}
  selector:
    matchLabels:
      app: {{ template "minio.name" . }}
      release: {{ .Release.Name }}
  template:
    metadata:
      name: {{ template "minio.fullname" . }}
      labels:
        app: {{ template "minio.name" . }}
        release: {{ .Release.Name }}
{{- if .Values.podLabels }}
{{ toYaml .Values.podLabels | indent 8 }}
{{- end }}
      annotations:
        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
{{- if .Values.podAnnotations }}
{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }}
{{- end }}
    spec:
  {{- if .Values.priorityClassName }}
      priorityClassName: "{{ .Values.priorityClassName }}"
  {{- end }}
      serviceAccountName: {{ include "minio.serviceAccountName" . | quote }}
{{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
      securityContext:
        runAsUser: {{ .Values.securityContext.runAsUser }}
        runAsGroup: {{ .Values.securityContext.runAsGroup }}
        fsGroup: {{ .Values.securityContext.fsGroup }}
{{- end }}
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          {{- if .Values.s3gateway.enabled }}
          command: [ "/bin/sh",
          "-ce",
          "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway s3 {{ .Values.s3gateway.serviceEndpoint }} {{- template `minio.extraArgs` . }}" ]
          {{- else }}
          {{- if .Values.azuregateway.enabled }}
          command: [ "/bin/sh",
          "-ce",
          "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway azure {{- template `minio.extraArgs` . }}" ]
          {{- else }}
          {{- if .Values.gcsgateway.enabled }}
          command: [ "/bin/sh",
          "-ce",
          "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway gcs {{ .Values.gcsgateway.projectId }} {{- template `minio.extraArgs` . }}" ]
          {{- else }}
          {{- if .Values.ossgateway.enabled }}
          command: [ "/bin/sh",
          "-ce",
          "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway oss {{ .Values.ossgateway.endpointURL }} {{- template `minio.extraArgs` . }}" ]
          {{- else }}
          {{- if .Values.nasgateway.enabled }}
          command: [ "/bin/sh",
          "-ce",
          "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway nas {{ $bucketRoot }} {{- template `minio.extraArgs` . }}" ]
          {{- else }}
          {{- if .Values.b2gateway.enabled }}
          command: [ "/bin/sh",
          "-ce",
          "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway b2 {{- template `minio.extraArgs` . }}" ]
          {{- else }}
          command: [ "/bin/sh",
          "-ce",
          "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{ $bucketRoot }} {{- template `minio.extraArgs` . }}" ]
          {{- end }}
          {{- end }}
          {{- end }}
          {{- end }}
          {{- end }}
          {{- end }}
          volumeMounts:
            {{- if and .Values.persistence.enabled (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) (not .Values.b2gateway.enabled) }}
            - name: export
              mountPath: {{ .Values.mountPath }}
              {{- if .Values.persistence.subPath }}
              subPath: "{{ .Values.persistence.subPath }}"
              {{- end }}
            {{- end }}
            {{- if or .Values.gcsgateway.enabled .Values.etcd.clientCert .Values.etcd.clientCertKey }}
            - name: minio-user
              mountPath: "/etc/credentials"
              readOnly: true
            {{- end }}
            {{- if .Values.tls.enabled }}
            - name: cert-secret-volume
              mountPath: {{ .Values.certsPath }}
            {{ end }}
          ports:
            {{- if .Values.tls.enabled }}
            - name: https
            {{ else }}
            - name: http
            {{- end }}
              containerPort: 9000
          env:
            - name: MINIO_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }}
                  key: accesskey
            - name: MINIO_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }}
                  key: secretkey
            {{- if .Values.gcsgateway.enabled }}
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: "/etc/credentials/gcs_key.json"
            {{- end }}
            {{- if .Values.etcd.endpoints }}
            - name: MINIO_ETCD_ENDPOINTS
              value: {{ join "," .Values.etcd.endpoints | quote }}
            {{- end }}
            {{- if .Values.etcd.clientCert }}
            - name: MINIO_ETCD_CLIENT_CERT
              value: "/etc/credentials/etcd_client_cert.pem"
            {{- end }}
            {{- if .Values.etcd.clientCertKey }}
            - name: MINIO_ETCD_CLIENT_CERT_KEY
              value: "/etc/credentials/etcd_client_cert_key.pem"
            {{- end }}
            {{- if .Values.etcd.pathPrefix }}
            - name: MINIO_ETCD_PATH_PREFIX
              value: {{ .Values.etcd.pathPrefix }}
            {{- end }}
            {{- if .Values.etcd.corednsPathPrefix }}
            - name: MINIO_ETCD_COREDNS_PATH
              value: {{ .Values.etcd.corednsPathPrefix }}
            {{- end }}
            {{- if .Values.s3gateway.enabled -}}
            {{- if .Values.s3gateway.accessKey }}
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }}
                  key: awsAccessKeyId
            {{- end }}
            {{- if .Values.s3gateway.secretKey }}
            - name: AWS_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }}
                  key: awsSecretAccessKey
            {{- end }}
            {{- end }}
            {{- range $key, $val := .Values.environment }}
            - name: {{ $key }}
              value: {{ $val | quote }}
            {{- end}}
          livenessProbe:
            httpGet:
              path: /minio/health/live
              {{- if .Values.tls.enabled }}
              port: https
              {{ else }}
              port: http
              {{- end }}
              {{- if .Values.tls.enabled }}
              scheme: HTTPS
              {{ else }}
              scheme: HTTP
              {{- end }}
            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
            successThreshold: {{ .Values.livenessProbe.successThreshold }}
            failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
          readinessProbe:
            httpGet:
              {{- if .Values.tls.enabled }}
              scheme: HTTPS
              {{- end }}
              path: /minio/health/ready
              {{- if .Values.tls.enabled }}
              port: https
              {{ else }}
              port: http
              {{- end }}
            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
            successThreshold: {{ .Values.readinessProbe.successThreshold }}
            failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
          resources:
{{ toYaml .Values.resources | indent 12 }}
{{- with .Values.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
{{- end }}
{{- include "minio.imagePullSecrets" . | indent 6 }}
{{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
{{- end }}
      volumes:
        {{- if and (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) (not .Values.b2gateway.enabled) }}
        - name: export
        {{- if .Values.persistence.enabled }}
          persistentVolumeClaim:
            claimName: {{ .Values.persistence.existingClaim | default (include "minio.fullname" .) }}
        {{- else }}
          emptyDir: {}
        {{- end }}
        {{- end }}
        - name: minio-user
          secret:
            secretName: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }}
        {{- if .Values.tls.enabled }}
        - name: cert-secret-volume
          secret:
            secretName: {{ .Values.tls.certSecret }}
            items:
            - key: {{ .Values.tls.publicCrt }}
              path: public.crt
            - key: {{ .Values.tls.privateKey }}
              path: private.key
            - key: {{ .Values.tls.publicCrt }}
              path: CAs/public.crt
        {{ end }}
{{- end }}
 # ingress.yaml
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "minio.fullname" . -}}
{{- $servicePort := .Values.service.port -}}
{{- $ingressPath := .Values.ingress.path -}}
apiVersion: {{ template "minio.ingress.apiVersion" . }}
kind: Ingress
metadata:
  name: {{ $fullName }}
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
{{- with .Values.ingress.labels }}
{{ toYaml . | indent 4 }}
{{- end }}

{{- with .Values.ingress.annotations }}
  annotations:
{{ toYaml . | indent 4 }}
{{- end }}
spec:
{{- if .Values.ingress.tls }}
  tls:
  {{- range .Values.ingress.tls }}
    - hosts:
      {{- range .hosts }}
        - {{ . | quote }}
      {{- end }}
      secretName: {{ .secretName }}
  {{- end }}
{{- end }}
  rules:
  {{- range .Values.ingress.hosts }}
    - http:
        paths:
          - path: {{ $ingressPath }}
            backend:
              serviceName: {{ $fullName }}
              servicePort: {{ $servicePort }}
      {{- if . }}
      host: {{ . | quote }}
      {{- end }}
  {{- end }}
{{- end }}
 # networkpolicy.yaml
{{- if .Values.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ template "minio.networkPolicy.apiVersion" . }}
metadata:
  name: {{ template "minio.fullname" . }}
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  podSelector:
    matchLabels:
      app: {{ template "minio.name" . }}
      release: {{ .Release.Name }}
  ingress:
    - ports:
        - port: {{ .Values.service.port }}
      {{- if not .Values.networkPolicy.allowExternal }}
      from:
        - podSelector:
            matchLabels:
              {{ template "minio.name" . }}-client: "true"
      {{- end }}
{{- end }}
 # poddisruptionbudget.yaml
{{- if .Values.podDisruptionBudget.enabled }}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: minio
  labels:
    app: {{ template "minio.name" . }}
spec:
  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
  selector:
    matchLabels:
      app: {{ template "minio.name" . }}
{{- end }} # post-install-create-bucket-job.yaml
{{- if or .Values.defaultBucket.enabled .Values.buckets }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "minio.fullname" . }}-make-bucket-job
  labels:
    app: {{ template "minio.name" . }}-make-bucket-job
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
{{- with .Values.makeBucketJob.annotations }}
{{ toYaml . | indent 4 }}
{{- end }}
spec:
  template:
    metadata:
      labels:
        app: {{ template "minio.name" . }}-job
        release: {{ .Release.Name }}
{{- if .Values.podLabels }}
{{ toYaml .Values.podLabels | indent 8 }}
{{- end }}
    spec:
      restartPolicy: OnFailure
{{- include "minio.imagePullSecrets" . | indent 6 }}
{{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
{{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
{{- end }}
      volumes:
        - name: minio-configuration
          projected:
            sources:
            - configMap:
                name: {{ template "minio.fullname" . }}
            - secret:
                name: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }}
        {{- if .Values.tls.enabled }}
        - name: cert-secret-volume-mc
          secret:
            secretName: {{ .Values.tls.certSecret }}
            items:
            - key: {{ .Values.tls.publicCrt }}
              path: CAs/public.crt
        {{ end }}
      serviceAccountName: {{ include "minio.serviceAccountName" . | quote }}
      containers:
      - name: minio-mc
        image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
        imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
        command: ["/bin/sh", "/config/initialize"]
        env:
          - name: MINIO_ENDPOINT
            value: {{ template "minio.fullname" . }}
          - name: MINIO_PORT
            value: {{ .Values.service.port | quote }}
        volumeMounts:
          - name: minio-configuration
            mountPath: /config
          {{- if .Values.tls.enabled }}
          - name: cert-secret-volume-mc
            mountPath: {{ .Values.configPathmc }}certs
          {{ end }}
        resources:
{{ toYaml .Values.resources | indent 10 }}
{{- end }}
 # post-install-prometheus-metrics-job.yaml
{{- if .Values.metrics.serviceMonitor.enabled }}
{{- $fullName := include "minio.fullname" . -}}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ $fullName }}-update-prometheus-secret
  labels:
    app: {{ template "minio.name" . }}-update-prometheus-secret
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "-5"
    "helm.sh/hook-delete-policy": hook-succeeded
  {{ toYaml .Values.updatePrometheusJob.annotations | indent 4 }}
spec:
  template:
    metadata:
      labels:
        app: {{ template "minio.name" . }}-update-prometheus-secret
        release: {{ .Release.Name }}
{{- if .Values.podLabels }}
{{ toYaml .Values.podLabels | indent 8 }}
{{- end }}
    spec:
{{- if .Values.serviceAccount.create }}
      serviceAccountName: {{ $fullName }}-update-prometheus-secret
{{- end }}
      restartPolicy: OnFailure
{{- include "minio.imagePullSecrets" . | indent 6 }}
{{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
{{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
{{- end }}
      volumes:
        - name: workdir
          emptyDir: {}
      initContainers:
        - name: minio-mc
          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
          imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
          command:
            - /bin/sh
            - "-c"
            - mc admin prometheus generate target --json --no-color -q > /workdir/mc.json
          env:
            # mc admin prometheus generate don't really connect to remote server, TLS cert isn't required
            - name: MC_HOST_target
              value: http{{ if .Values.tls.enabled }}s{{ end }}://{{ .Values.accessKey }}:{{ .Values.secretKey }}@{{ $fullName }}:{{ .Values.service.port }}
          volumeMounts:
            - name: workdir
              mountPath: /workdir
          resources:
{{ toYaml .Values.resources | indent 12 }}
        # extract bearerToken from mc admin output
        - name: jq
          image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}"
          imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }}
          command:
            - /bin/sh
            - "-c"
            - jq -e -c -j -r .bearerToken < /workdir/mc.json > /workdir/token
          volumeMounts:
            - name: workdir
              mountPath: /workdir
          resources:
{{ toYaml .Values.resources | indent 12 }}
        - name: kubectl-create
          image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}"
          imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }}
          command:
            - /bin/sh
            - "-c"
            # The following script does:
            # - get the servicemonitor that need this secret and copy some metadata and create the ownerreference for the secret file
            # - create the secret
            # - merge both json
            - >
              kubectl -n {{ .Release.Namespace }} get servicemonitor {{ $fullName }} -o json |
                jq -c '{metadata: {name: "{{ $fullName }}-prometheus", namespace: .metadata.namespace, labels: {app: .metadata.labels.app, release: .metadata.labels.release}, ownerReferences: [{apiVersion: .apiVersion, kind: .kind, blockOwnerDeletion: true, controller: true, uid: .metadata.uid, name: .metadata.name}]}}' > /workdir/metadata.json &&
              kubectl create secret generic {{ $fullName }}-prometheus --from-file=token=/workdir/token --dry-run -o json > /workdir/secret.json &&
              cat /workdir/secret.json /workdir/metadata.json | jq -s add > /workdir/object.json
          volumeMounts:
            - name: workdir
              mountPath: /workdir
          resources:
{{ toYaml .Values.resources | indent 12 }}
      containers:
        - name: kubectl-apply
          image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}"
          imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }}
          command:
            - kubectl
            - apply
            - "-f"
            - /workdir/object.json
          volumeMounts:
            - name: workdir
              mountPath: /workdir
          resources:
{{ toYaml .Values.resources | indent 12 }}
{{- end }}
 # post-install-prometheus-metrics-role.yaml
{{- if .Values.serviceAccount.create -}}
{{- $fullName := include "minio.fullname" . -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ $fullName }}-update-prometheus-secret
  labels:
    app: {{ template "minio.name" . }}-update-prometheus-secret
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - create
      - update
      - patch
    resourceNames:
      - {{ $fullName }}-prometheus
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - create
  - apiGroups:
      - monitoring.coreos.com
    resources:
      - servicemonitors
    verbs:
      - get
    resourceNames:
      - {{ $fullName }}
{{- end -}} # post-install-prometheus-metrics-rolebinding.yaml
{{- if .Values.serviceAccount.create -}}
{{- $fullName := include "minio.fullname" . -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ $fullName }}-update-prometheus-secret
  labels:
    app: {{ template "minio.name" . }}-update-prometheus-secret
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ $fullName }}-update-prometheus-secret
subjects:
  - kind: ServiceAccount
    name: {{ $fullName }}-update-prometheus-secret
    namespace: {{ .Release.Namespace | quote }}
{{- end -}} # post-install-prometheus-metrics-serviceaccount.yaml
{{- if .Values.serviceAccount.create -}}
{{- $fullName := include "minio.fullname" . -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ $fullName }}-update-prometheus-secret
  labels:
    app: {{ template "minio.name" . }}-update-prometheus-secret
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
{{- end -}} # pvc.yaml
{{- if eq .Values.mode "standalone" }}
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ template "minio.fullname" . }}
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
{{- if and .Values.nasgateway.enabled .Values.nasgateway.pv }}
  selector:
    matchLabels:
      pv: {{ .Values.nasgateway.pv | quote }}
{{- end }}
  accessModes:
    - {{ .Values.persistence.accessMode | quote }}
  resources:
    requests:
      storage: {{ .Values.persistence.size | quote }}
      
{{- if .Values.persistence.storageClass }}
{{- if (eq "-" .Values.persistence.storageClass) }}
  storageClassName: ""
{{- else }}
  storageClassName: "{{ .Values.persistence.storageClass }}"
{{- end }}
{{- end }}
{{- if .Values.persistence.VolumeName }}
  volumeName: "{{ .Values.persistence.VolumeName }}"
{{- end }}
{{- end }}
{{- end }}
 # secrets.yaml
{{- if not .Values.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "minio.fullname" . }}
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
type: Opaque
data:
  accesskey: {{ if .Values.accessKey }}{{ .Values.accessKey | b64enc | quote }}{{ else }}{{ randAlphaNum 20 | b64enc | quote }}{{ end }}
  secretkey: {{ if .Values.secretKey }}{{ .Values.secretKey | b64enc | quote }}{{ else }}{{ randAlphaNum 40 | b64enc | quote }}{{ end }}
{{- if .Values.gcsgateway.enabled }}
  gcs_key.json: {{ .Values.gcsgateway.gcsKeyJson | b64enc }}
{{- end }}
{{- if .Values.s3gateway.enabled -}}
{{- if .Values.s3gateway.accessKey }}
  awsAccessKeyId: {{ .Values.s3gateway.accessKey | b64enc | quote }}
{{- end }}
{{- if .Values.s3gateway.secretKey }}
  awsSecretAccessKey: {{ .Values.s3gateway.secretKey | b64enc | quote }}
{{- end }}
{{- end }}
{{- if .Values.etcd.clientCert }}
  etcd_client_cert.pem: {{ .Values.etcd.clientCert | b64enc | quote }}
{{- end }}
{{- if .Values.etcd.clientCertKey }}
  etcd_client_cert_key.pem: {{ .Values.etcd.clientCertKey | b64enc | quote }}
{{- end }}
{{- end }}
 # service.yaml
apiVersion: v1
kind: Service
metadata:
  name: {{ template "minio.fullname" . }}
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
{{- if .Values.service.annotations }}
  annotations:
{{ toYaml .Values.service.annotations | indent 4 }}
{{- end }}
spec:
{{- if (or (eq .Values.service.type "ClusterIP" "") (empty .Values.service.type)) }}
  type: ClusterIP
  {{- if not (empty .Values.service.clusterIP) }}
  clusterIP: {{ .Values.service.clusterIP }}
  {{end}}
{{- else if eq .Values.service.type "LoadBalancer" }}
  type: {{ .Values.service.type }}
  loadBalancerIP: {{ default "" .Values.service.loadBalancerIP }}
{{- else }}
  type: {{ .Values.service.type }}
{{- end }}
  ports:
    {{- if .Values.tls.enabled }}
    - name: https
    {{ else }}
    - name: http
    {{- end }}
      port: {{ .Values.service.port }}
      protocol: TCP
{{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }}
      nodePort: {{ .Values.service.nodePort }}
{{- else }}
      targetPort: 9000
{{- end}}
{{- if .Values.service.externalIPs }}
  externalIPs:
{{- range $i , $ip := .Values.service.externalIPs }}
  - {{ $ip }}
{{- end }}
{{- end }}
  selector:
    app: {{ template "minio.name" . }}
    release: {{ .Release.Name }}
 # serviceaccount.yaml
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "minio.serviceAccountName" . | quote }}
  namespace: {{ .Release.Namespace | quote }}
{{- end -}}
 # servicemonitor.yaml
{{- if .Values.metrics.serviceMonitor.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: {{ template "minio.fullname" . }}
  {{- if .Values.metrics.serviceMonitor.namespace }}
  namespace: {{ .Values.metrics.serviceMonitor.namespace }}
  {{- end }}
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- if .Values.metrics.serviceMonitor.additionalLabels }}
{{ toYaml .Values.metrics.serviceMonitor.additionalLabels | indent 4 }}
    {{- end }}
spec:
  endpoints:
    {{- if .Values.tls.enabled }}
    - port: https
    {{ else }}
    - port: http
    {{- end }}
      path: /minio/prometheus/metrics
      {{- if .Values.metrics.serviceMonitor.interval }}
      interval: {{ .Values.metrics.serviceMonitor.interval }}
      {{- end }}
      {{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
      scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
      {{- end }}
      bearerTokenSecret:
        name: {{ template "minio.fullname" . }}-prometheus
        key: token
  namespaceSelector:
    matchNames:
      - {{ .Release.Namespace | quote }}
  selector:
    matchLabels:
      app: {{ include "minio.name" . }}
      release: {{ .Release.Name }}
{{- end }}
 # statefulset.yaml
{{- if eq .Values.mode "distributed" }}
{{ $zoneCount := .Values.zones | int }}
{{ $nodeCount := .Values.replicas | int }}
{{ $drivesPerNode := .Values.drivesPerNode | int }}
{{ $scheme := "http" }}
{{- if .Values.tls.enabled }}
{{ $scheme = "https" }}
{{ end }}
{{ $mountPath := .Values.mountPath }}
{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }}
{{ $subPath := .Values.persistence.subPath }}
{{ $penabled := .Values.persistence.enabled }}
{{ $accessMode := .Values.persistence.accessMode }}
{{ $storageClass := .Values.persistence.storageClass }}
{{ $psize := .Values.persistence.size }}
apiVersion: v1
kind: Service
metadata:
  name: {{ template "minio.fullname" . }}-svc
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  publishNotReadyAddresses: true
  clusterIP: None
  ports:
    {{- if .Values.tls.enabled }}
    - name: https
    {{ else }}
    - name: http
    {{- end }}
      port: {{ .Values.service.port }}
      protocol: TCP
  selector:
    app: {{ template "minio.name" . }}
    release: {{ .Release.Name }}
---
apiVersion: {{ template "minio.statefulset.apiVersion" . }}
kind: StatefulSet
metadata:
  name: {{ template "minio.fullname" . }}
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  updateStrategy:
    type: {{ .Values.StatefulSetUpdate.updateStrategy }}
  podManagementPolicy: "Parallel"
  serviceName: {{ template "minio.fullname" . }}-svc
  replicas: {{ mul $zoneCount $nodeCount }}
  selector:
    matchLabels:
      app: {{ template "minio.name" . }}
      release: {{ .Release.Name }}
  template:
    metadata:
      name: {{ template "minio.fullname" . }}
      labels:
        app: {{ template "minio.name" . }}
        release: {{ .Release.Name }}
{{- if .Values.podLabels }}
{{ toYaml .Values.podLabels | indent 8 }}
{{- end }}
      annotations:
        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
{{- if .Values.podAnnotations }}
{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }}
{{- end }}
    spec:
      {{- if .Values.priorityClassName }}
      priorityClassName: "{{ .Values.priorityClassName }}"
      {{- end }}
      serviceAccountName: {{ include "minio.serviceAccountName" . | quote }}
{{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
      securityContext:
        runAsUser: {{ .Values.securityContext.runAsUser }}
        runAsGroup: {{ .Values.securityContext.runAsGroup }}
        fsGroup: {{ .Values.securityContext.fsGroup }}
{{- end }}
      containers:
        - name: {{ .Chart.Name }}
          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}

          command: [ "/bin/sh",
            "-ce",
            "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{- range $i := until $zoneCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }}  {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{else}}{{ $bucketRoot }}{{end}}{{- end}}{{- template `minio.extraArgs` . }}" ]
          volumeMounts:
            {{- if $penabled }}
            {{- if (gt $drivesPerNode 1) }}
            {{- range $i := until $drivesPerNode }}
            - name: export-{{ $i }}
              mountPath: {{ $mountPath }}-{{ $i }}
              {{- if and $penabled $subPath }}
              subPath: {{ $subPath }}
              {{- end }}
            {{- end }}
            {{- else }}
            - name: export
              mountPath: {{ $mountPath }}
              {{- if and $penabled $subPath }}
              subPath: {{ $subPath }}
              {{- end }}
            {{- end }}
            {{- end }}
            {{- if .Values.tls.enabled }}
            - name: cert-secret-volume
              mountPath: {{ .Values.certsPath }}
            {{ end }}
          ports:
            {{- if .Values.tls.enabled }}
            - name: https
            {{ else }}
            - name: http
            {{- end }}
              containerPort: 9000
          env:
            - name: MINIO_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }}
                  key: accesskey
            - name: MINIO_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }}
                  key: secretkey
            {{- range $key, $val := .Values.environment }}
            - name: {{ $key }}
              value: {{ $val | quote }}
            {{- end}}
          livenessProbe:
            httpGet:
              path: /minio/health/live
              {{- if .Values.tls.enabled }}
              port: https
              {{ else }}
              port: http
              {{- end }}
              {{- if .Values.tls.enabled }}
              scheme: HTTPS
              {{ else }}
              scheme: HTTP
              {{- end }}
            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
            successThreshold: {{ .Values.livenessProbe.successThreshold }}
            failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
          readinessProbe:
            httpGet:
              path: /minio/health/ready
              {{- if .Values.tls.enabled }}
              port: https
              {{ else }}
              port: http
              {{- end }}
              {{- if .Values.tls.enabled }}
              scheme: HTTPS
              {{ else }}
              scheme: HTTP
              {{- end }}
            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
            successThreshold: {{ .Values.readinessProbe.successThreshold }}
            failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
          resources:
{{ toYaml .Values.resources | indent 12 }}
    {{- with .Values.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
    {{- end }}
{{- include "minio.imagePullSecrets" . | indent 6 }}
    {{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
    {{- end }}
      volumes:
        - name: minio-user
          secret:
            secretName: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }}
        {{- if .Values.tls.enabled }}
        - name: cert-secret-volume
          secret:
            secretName: {{ .Values.tls.certSecret }}
            items:
            - key: {{ .Values.tls.publicCrt }}
              path: public.crt
            - key: {{ .Values.tls.privateKey }}
              path: private.key
            - key: {{ .Values.tls.publicCrt }}
              path: CAs/public.crt
        {{ end }}
{{- if .Values.persistence.enabled }}
  volumeClaimTemplates:
  {{- if gt $drivesPerNode 1 }}
    {{- range $diskId := until $drivesPerNode}}
    - metadata:
        name: export-{{ $diskId }}
      spec:
        accessModes: [ {{ $accessMode | quote }} ]
        {{- if $storageClass }}
        storageClassName: {{ $storageClass }}
        {{- end }}
        resources:
          requests:
            storage: {{ $psize }}
    {{- end }}
  {{- else }}
    - metadata:
        name: export
      spec:
        accessModes: [ {{ $accessMode | quote }} ]
        {{- if $storageClass }}
        storageClassName: {{ $storageClass }}
        {{- end }}
        resources:
          requests:
            storage: {{ $psize }}
  {{- end }}
{{- end }}
{{- end }}

## Provide a name in place of minio for `app:` labels
##
nameOverride: ""

## Provide a name to substitute for the full names of resources
##
fullnameOverride: ""

## set kubernetes cluster domain where minio is running
##
clusterDomain: cluster.local

## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the
##
image:
  repository: minio/minio
  tag: RELEASE.2020-06-14T18-32-17Z
  pullPolicy: IfNotPresent

## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio
## client used to create a default bucket).
##
mcImage:
  repository: minio/mc
  tag: RELEASE.2020-05-28T23-43-36Z
  pullPolicy: IfNotPresent

## Set default image, imageTag, and imagePullPolicy for the `jq` (the JSON
## process used to create secret for prometheus ServiceMonitor).
##
helmKubectlJqImage:
  repository: bskim45/helm-kubectl-jq
  tag: 3.1.0
  pullPolicy: IfNotPresent

## minio server mode, i.e. standalone or distributed.
## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide
##
mode: standalone

## Additional arguments to pass to minio binary
extraArgs: []

## Update strategy for Deployments
DeploymentUpdate:
  type: RollingUpdate
  maxUnavailable: 0
  maxSurge: 100%

## Update strategy for StatefulSets
StatefulSetUpdate:
  updateStrategy: RollingUpdate

## Pod priority settings
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
##
priorityClassName: ""

## Set default accesskey, secretkey, Minio config file path, volume mount path and
## number of nodes (only used for Minio distributed mode)
## AccessKey and secretKey is generated when not set
## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide
##
existingSecret: ""
accessKey: "AKIAIOSFODNN7EXAMPLE"
secretKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
certsPath: "/etc/minio/certs/"
configPathmc: "/etc/minio/mc/"
mountPath: "/export"

## Override the root directory which the minio server should serve from.
## If left empty, it defaults to the value of {{ .Values.mountPath }}
## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }}
bucketRoot: ""

# Number of drives attached to a node
drivesPerNode: 1
# Number of MinIO containers running
replicas: 4
# Number of expanded MinIO clusters
zones: 1

## TLS Settings for Minio
tls:
  enabled: false
  ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
  certSecret: ""
  publicCrt: public.crt
  privateKey: private.key

## Enable persistence using Persistent Volume Claims
## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
##
persistence:
  enabled: true

  ## A manually managed Persistent Volume and Claim
  ## Requires persistence.enabled: true
  ## If defined, PVC must be created manually before volume will be bound
  existingClaim: ""

  ## minio data Persistent Volume Storage Class
  ## If defined, storageClassName: <storageClass>
  ## If set to "-", storageClassName: "", which disables dynamic provisioning
  ## If undefined (the default) or set to null, no storageClassName spec is
  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
  ##   GKE, AWS & OpenStack)
  ##
  ## Storage class of PV to bind. By default it looks for standard storage class.
  ## If the PV uses a different storage class, specify that here.
  storageClass: ""
  VolumeName: ""
  accessMode: ReadWriteOnce
  size: 500Gi

  ## If subPath is set mount a sub folder of a volume instead of the root of the volume.
  ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs).
  ##
  subPath: ""

## Expose the Minio service to be accessed from outside the cluster (LoadBalancer service).
## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.
## ref: http://kubernetes.io/docs/user-guide/services/
##

service:
  type: ClusterIP
  clusterIP: ~
  port: 9000
  nodePort: 32000

  ## List of IP addresses at which the Prometheus server service is available
  ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
  ##
  externalIPs: []
  #   - externalIp1

  annotations: {}
    # prometheus.io/scrape: 'true'
    # prometheus.io/path:   '/minio/prometheus/metrics'
    # prometheus.io/port:   '9000'

## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/
##

imagePullSecrets: []
# - name: "image-pull-secret"

ingress:
  enabled: false
  labels: {}
    # node-role.kubernetes.io/ingress: platform

  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
    # kubernetes.io/ingress.allow-http: "false"
    # kubernetes.io/ingress.global-static-ip-name: ""
    # nginx.ingress.kubernetes.io/secure-backends: "true"
    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
  path: /
  hosts:
    - chart-example.local
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

## Node labels for pod assignment
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
##
nodeSelector: {}
tolerations: []
affinity: {}

## Add stateful containers to have security context, if enabled MinIO will run as this
## user and group NOTE: securityContext is only enabled if persistence.enabled=true
securityContext:
  enabled: true
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000

# Additational pod annotations
podAnnotations: {}

# Additional pod labels
podLabels: {}

## Liveness and Readiness probe values.
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
livenessProbe:
  initialDelaySeconds: 5
  periodSeconds: 5
  timeoutSeconds: 1
  successThreshold: 1
  failureThreshold: 1
readinessProbe:
  initialDelaySeconds: 30
  periodSeconds: 5
  ## Set this to 1s higher than MINIO_API_READY_DEADLINE
  timeoutSeconds: 6
  successThreshold: 1
  failureThreshold: 3

## Configure resource requests and limits
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
##
resources:
  requests:
    memory: 4Gi

## Create a bucket after minio install
##
defaultBucket:
  enabled: false
  ## If enabled, must be a string with length > 0
  name: bucket
  ## Can be one of none|download|upload|public
  policy: none
  ## Purge if bucket exists already
  purge: false

## Create multiple buckets after minio install
## Enabling `defaultBucket` will take priority over this list
##
buckets: []
  # - name: bucket1
  #   policy: none
  #   purge: false
  # - name: bucket2
  #   policy: none
  #   purge: false

## Additional Annotations for the Kubernetes Batch (make-bucket-job)
makeBucketJob:
  annotations:

## Additional Annotations for the Kubernetes Batch (update-prometheus-secret)
updatePrometheusJob:
  annotations:

s3gateway:
  enabled: false
  replicas: 4
  serviceEndpoint: ""
  accessKey: ""
  secretKey: ""

## Use minio as an azure blob gateway, you should disable data persistence so no volume claim are created.
## https://docs.minio.io/docs/minio-gateway-for-azure
azuregateway:
  enabled: false
  # Number of parallel instances
  replicas: 4

## Use minio as GCS (Google Cloud Storage) gateway, you should disable data persistence so no volume claim are created.
## https://docs.minio.io/docs/minio-gateway-for-gcs

gcsgateway:
  enabled: false
  # Number of parallel instances
  replicas: 4
  # credential json file of service account key
  gcsKeyJson: ""
  # Google cloud project-id
  projectId: ""

ossgateway:
  enabled: false
  # Number of parallel instances
  replicas: 4
  endpointURL: ""

## Use minio on NAS backend
## https://docs.minio.io/docs/minio-gateway-for-nas

nasgateway:
  enabled: false
  # Number of parallel instances
  replicas: 4
  # For NAS Gateway, you may want to bind the PVC to a specific PV. To ensure that happens, PV to bind to should have
  # a label like "pv: <value>", use value here.
  pv: ~

## Use minio as Backblaze B2 gateway
## https://github.com/minio/minio/blob/master/docs/gateway/b2.md
b2gateway:
  enabled: false
  # Number of parallel instances
  replicas: 4

## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s)
## when Chart is deployed
environment:
  MINIO_API_READY_DEADLINE: "5s"
  ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html

networkPolicy:
  enabled: false
  allowExternal: true

## PodDisruptionBudget settings
## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
##
podDisruptionBudget:
  enabled: false
  maxUnavailable: 1

## Specify the service account to use for the Minio pods. If 'create' is set to 'false'
## and 'name' is left unspecified, the account 'default' will be used.
serviceAccount:
  create: true
  ## The name of the service account to use. If 'create' is 'true', a service account with that name
  ## will be created. Otherwise, a name will be auto-generated.
  name:

metrics:
  # Metrics can not be disabled yet: https://github.com/minio/minio/issues/7493
  serviceMonitor:
    enabled: false
    additionalLabels: {}
    # namespace: monitoring
    # interval: 30s
    # scrapeTimeout: 10s

## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md
etcd:
  endpoints: []
  pathPrefix: ""
  corednsPathPrefix: ""
  clientCert: ""
  clientCertKey: ""
