# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}

{{- define "reloader-name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" | lower -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "reloader-fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{- define "reloader-labels.chart" -}}
app: {{ template "reloader-fullname" . }}
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: {{ .Release.Name | quote }}
heritage: {{ .Release.Service | quote }}
{{- end -}}

{{/*
Create the name of the service account to use
*/}}
{{- define "reloader-serviceAccountName" -}}
{{- if .Values.reloader.serviceAccount.create -}}
    {{ default (include "reloader-fullname" .) .Values.reloader.serviceAccount.name }}
{{- else -}}
    {{ default "default" .Values.reloader.serviceAccount.name }}
{{- end -}}
{{- end -}}
 # clusterrole.yaml
{{- if and .Values.reloader.watchGlobally (.Values.reloader.rbac.enabled) }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  labels:
{{ include "reloader-labels.chart" . | indent 4 }}
{{- if .Values.reloader.rbac.labels }}
{{ toYaml .Values.reloader.rbac.labels | indent 4 }}
{{- end }}
{{- if .Values.reloader.matchLabels }}
{{ toYaml .Values.reloader.matchLabels | indent 4 }}
{{- end }}
  name: {{ template "reloader-fullname" . }}-role
  namespace: {{ .Release.Namespace }}
rules:
  - apiGroups:
      - ""
    resources:
{{- if .Values.reloader.ignoreSecrets }}{{- else }}
      - secrets
{{- end }}
{{- if .Values.reloader.ignoreConfigMaps }}{{- else }}
      - configmaps
{{- end }}
    verbs:
      - list
      - get
      - watch
{{- if or (.Capabilities.APIVersions.Has "apps.openshift.io/v1") (.Values.isOpenshift) }}
  - apiGroups:
      - "apps.openshift.io"
      - ""
    resources:
      - deploymentconfigs
    verbs:
      - list
      - get
      - update
      - patch
{{- end }}
  - apiGroups:
      - "apps"
    resources:
      - deployments
      - daemonsets
      - statefulsets
    verbs:
      - list
      - get
      - update
      - patch
  - apiGroups:
      - "extensions"
    resources:
      - deployments
      - daemonsets
    verbs:
      - list
      - get
      - update
      - patch
{{- end }}
 # clusterrolebinding.yaml
{{- if and .Values.reloader.watchGlobally (.Values.reloader.rbac.enabled) }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  labels:
{{ include "reloader-labels.chart" . | indent 4 }}
{{- if .Values.reloader.rbac.labels }}
{{ toYaml .Values.reloader.rbac.labels | indent 4 }}
{{- end }}
{{- if .Values.reloader.matchLabels }}
{{ toYaml .Values.reloader.matchLabels | indent 4 }}
{{- end }}
  name: {{ template "reloader-fullname" . }}-role-binding
  namespace: {{ .Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template "reloader-fullname" . }}-role
subjects:
  - kind: ServiceAccount
    name: {{ template "reloader-serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
{{- end }}
 # deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
{{- if .Values.reloader.deployment.annotations }}
  annotations:
{{ toYaml .Values.reloader.deployment.annotations | indent 4 }}
{{- end }}
  labels:
{{ include "reloader-labels.chart" . | indent 4 }}
{{- if .Values.reloader.deployment.labels }}
{{ toYaml .Values.reloader.deployment.labels | indent 4 }}
{{- end }}
{{- if .Values.reloader.matchLabels }}
{{ toYaml .Values.reloader.matchLabels | indent 4 }}
{{- end }}
  name: {{ template "reloader-fullname" . }}
spec:
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: {{ template "reloader-fullname" . }}
      release: {{ .Release.Name | quote }}
{{- if .Values.reloader.matchLabels }}
{{ toYaml .Values.reloader.matchLabels | indent 6 }}
{{- end }}
  template:
    metadata:
      labels:
{{ include "reloader-labels.chart" . | indent 8 }}
{{- if .Values.reloader.deployment.labels }}
{{ toYaml .Values.reloader.deployment.labels | indent 8 }}
{{- end }}
{{- if .Values.reloader.matchLabels }}
{{ toYaml .Values.reloader.matchLabels | indent 8 }}
{{- end }}
    spec:
      {{- if .Values.reloader.deployment.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.reloader.deployment.nodeSelector | indent 8 }}
      {{- end }}
      {{- if .Values.reloader.deployment.affinity }}
      affinity:
{{ toYaml .Values.reloader.deployment.affinity | indent 8 }}
      {{- end }}
      {{- if .Values.reloader.deployment.tolerations }}
      tolerations:
{{ toYaml .Values.reloader.deployment.tolerations | indent 8 }}
      {{- end }}
      containers:
      - env:
      {{- range $name, $value := .Values.reloader.deployment.env.open }}
      {{- if not (empty $value) }}
        - name: {{ $name | quote }}
          value: {{ $value | quote }}
      {{- end }}
      {{- end }}
      {{- $secret_name := include "reloader-fullname" . }}
      {{- range $name, $value := .Values.reloader.deployment.env.secret }}
      {{- if not ( empty $value) }}
        - name: {{ $name | quote }}
          valueFrom:
            secretKeyRef:
              name: {{ $secret_name }}
              key: {{ $name | quote }}
      {{- end }}
      {{- end }}
      {{- range $name, $value := .Values.reloader.deployment.env.field }}
      {{- if not ( empty $value) }}
        - name: {{ $name | quote }}
          valueFrom:
            fieldRef:
              fieldPath: {{ $value | quote}}
      {{- end }}
      {{- end }}
      {{- if eq .Values.reloader.watchGlobally false }}
        - name: KUBERNETES_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
      {{- end }}
        image: "{{ .Values.reloader.deployment.image.name }}:{{ .Values.reloader.deployment.image.tag }}"
        imagePullPolicy: {{ .Values.reloader.deployment.image.pullPolicy }}
        name: {{ template "reloader-fullname" . }}
      {{- if eq .Values.reloader.readOnlyRootFileSystem true }}
        volumeMounts:
          - mountPath: /tmp/
            name: tmp-volume
      {{- end }}
        args:
          {{- if .Values.reloader.ignoreSecrets }}
          - "--resources-to-ignore=secrets"
          {{- end }}
          {{- if eq .Values.reloader.ignoreConfigMaps true }}
          - "--resources-to-ignore=configMaps"
          {{- end }}

          {{- if .Values.reloader.custom_annotations }}
            {{- if .Values.reloader.custom_annotations.configmap }}
            - "--configmap-annotation"
            - "{{ .Values.reloader.custom_annotations.configmap }}"
            {{- end }}
            {{- if .Values.reloader.custom_annotations.secret }}
            - "--secret-annotation"
            - "{{ .Values.reloader.custom_annotations.secret }}"
            {{- end }}
            {{- if .Values.reloader.custom_annotations.auto }}
            - "--auto-annotation"
            - "{{ .Values.reloader.custom_annotations.auto }}"
            {{- end }}
          {{- end }}

      {{- if .Values.reloader.deployment.resources }}
        resources:
{{ toYaml .Values.reloader.deployment.resources | indent 10 }}
      {{- end }}
{{- if .Values.reloader.deployment.securityContext }}
      securityContext: {{ toYaml .Values.reloader.deployment.securityContext | nindent 8 }}
{{- end }}
      serviceAccountName: {{ template "reloader-serviceAccountName" . }}
    {{- if eq .Values.reloader.readOnlyRootFileSystem true }}
      volumes:
        - emptyDir: {}
          name: tmp-volume
    {{- end }}
 # role.yaml
{{- if and (not (.Values.reloader.watchGlobally)) (.Values.reloader.rbac.enabled) }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  labels:
{{ include "reloader-labels.chart" . | indent 4 }}
{{- if .Values.reloader.rbac.labels }}
{{ toYaml .Values.reloader.rbac.labels | indent 4 }}
{{- end }}
{{- if .Values.reloader.matchLabels }}
{{ toYaml .Values.reloader.matchLabels | indent 4 }}
{{- end }}
  name: {{ template "reloader-fullname" . }}-role
  namespace: {{ .Release.Namespace }}
rules:
  - apiGroups:
      - ""
    resources:
{{- if .Values.reloader.ignoreSecrets }}{{- else }}
      - secrets
{{- end }}
{{- if .Values.reloader.ignoreConfigMaps }}{{- else }}
      - configmaps
{{- end }}
    verbs:
      - list
      - get
      - watch
{{- if or (.Capabilities.APIVersions.Has "apps.openshift.io/v1") (.Values.isOpenshift) }}
  - apiGroups:
      - "apps.openshift.io"
      - ""
    resources:
      - deploymentconfigs
    verbs:
      - list
      - get
      - update
      - patch
{{- end }}
  - apiGroups:
      - "apps"
    resources:
      - deployments
      - daemonsets
      - statefulsets
    verbs:
      - list
      - get
      - update
      - patch
  - apiGroups:
      - "extensions"
    resources:
      - deployments
      - daemonsets
    verbs:
      - list
      - get
      - update
      - patch
{{- end }}
 # rolebinding.yaml
{{- if and (not (.Values.reloader.watchGlobally)) (.Values.reloader.rbac.enabled) }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  labels:
{{ include "reloader-labels.chart" . | indent 4 }}
{{- if .Values.reloader.rbac.labels }}
{{ toYaml .Values.reloader.rbac.labels | indent 4 }}
{{- end }}
{{- if .Values.reloader.matchLabels }}
{{ toYaml .Values.reloader.matchLabels | indent 4 }}
{{- end }}
  name: {{ template "reloader-fullname" . }}-role-binding
  namespace: {{ .Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ template "reloader-fullname" . }}-role
subjects:
  - kind: ServiceAccount
    name: {{ template "reloader-serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
{{- end }}
 # serviceaccount.yaml
{{- if .Values.reloader.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets: {{ toYaml .Values.global.imagePullSecrets | nindent 2 }}
{{- end }}
metadata:
  labels:
{{ include "reloader-labels.chart" . | indent 4 }}
{{- if .Values.reloader.serviceAccount.labels }}
{{ toYaml .Values.reloader.serviceAccount.labels | indent 4 }}
{{- end }}
{{- if .Values.reloader.matchLabels }}
{{ toYaml .Values.reloader.matchLabels | indent 4 }}
{{- end }}
  name: {{ template "reloader-serviceAccountName" . }}
{{- end }}

global:
  ## Reference to one or more secrets to be used when pulling images
  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  ##
  imagePullSecrets: []
  # - name: "image-pull-secret"

kubernetes:
  host: https://kubernetes.default

reloader:
  isOpenshift: false
  ignoreSecrets: false
  ignoreConfigMaps: false
  watchGlobally: true
  # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem
  readOnlyRootFileSystem: false
  matchLabels: {}
  deployment:
    nodeSelector:
    # cloud.google.com/gke-nodepool: default-pool

    # An affinity stanza to be applied to the Deployment.
    # Example:
    #   affinity:
    #     nodeAffinity:
    #       requiredDuringSchedulingIgnoredDuringExecution:
    #         nodeSelectorTerms:
    #         - matchExpressions:
    #           - key: "node-role.kubernetes.io/infra-worker"
    #             operator: "Exists"
    affinity: {}

    # A list of tolerations to be applied to the Deployment.
    # Example:
    #   tolerations:
    #   - key: "node-role.kubernetes.io/infra-worker"
    #     operator: "Exists"
    #     effect: "NoSchedule"
    tolerations: []

    annotations: {}
    labels:
      provider: stakater
      group: com.stakater.platform
      version: v0.0.41
    image:
      name: stakater/reloader
      tag: "v0.0.41"
      pullPolicy: IfNotPresent
    # Support for extra environment variables.
    env:
      # Open supports Key value pair as environment variables.
      open:
      # secret supports Key value pair as environment variables. It gets the values based on keys from default reloader secret if any.
      secret:
      # field supports Key value pair as environment variables. It gets the values from other fields of pod.
      field:

    # Specify resource requests/limits for the deployment.
    # Example:
    # resources:
    #   limits:
    #     cpu: "100m"
    #     memory: "512Mi"
    #   requests:
    #     cpu: "10m"
    #     memory: "128Mi"
    resources: {}
    # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
    securityContext: {}
    # runAsUser: 1000

  rbac:
    enabled: true
    labels: {}
  # Service account config for the agent pods
  serviceAccount:
    # Specifies whether a ServiceAccount should be created
    create: true
    labels: {}
    # The name of the ServiceAccount to use.
    # If not set and create is true, a name is generated using the fullname template
    name:
  # Optional flags to pass to the Reloader entrypoint
  # Example:
  #   custom_annotations:
  #     configmap: "my.company.com/configmap"
  #     secret: "my.company.com/secret"
  custom_annotations: {}
