{{- if .Values.enabled }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "teleport-cluster.operator.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels: {{- include "teleport-cluster.operator.labels" . | nindent 4 }}
  {{- if .Values.annotations.deployment }}
  annotations: {{- toYaml .Values.annotations.deployment | nindent 4 }}
  {{- end }}
spec:
  replicas: {{ .Values.highAvailability.replicaCount }}
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
  selector:
    matchLabels: {{- include "teleport-cluster.operator.selectorLabels" . | nindent 6 }}
  template:
    metadata:
  {{- if .Values.annotations.pod }}
      annotations: {{- toYaml .Values.annotations.pod | nindent 8 }}
  {{- end }}
      labels: {{- include "teleport-cluster.operator.labels" . | nindent 8 }}
    spec:
  {{- if .Values.nodeSelector }}
      nodeSelector: {{- toYaml .Values.nodeSelector | nindent 8 }}
  {{- end }}
  {{- if .Values.affinity }}
      affinity: {{- toYaml .Values.affinity | nindent 8 }}
  {{- end }}
  {{- if .Values.tolerations }}
      tolerations: {{- toYaml .Values.tolerations | nindent 8 }}
  {{- end }}
  {{- if .Values.imagePullSecrets }}
      imagePullSecrets: {{- toYaml .Values.imagePullSecrets | nindent 8 }}
  {{- end }}
      containers:
        - name: "operator"
          image: '{{ .Values.image }}:{{ include "teleport-cluster.version" . }}'
          imagePullPolicy: {{ .Values.imagePullPolicy }}
          command:
            - /teleport-operator
            - -auth-server
            - '{{ include "teleport-cluster.operator.teleportAddress" . }}'
            - -join-method
            - '{{ .Values.joinMethod }}'
            - -token
            - '{{ .Values.token }}'
  {{- if .Values.caPins }}
            - -ca-pin
            - '{{ join "," .Values.caPins }}'
  {{- end }}
  {{- if or (.Values.tls.existingCASecretName) (.Values.teleportClusterName) }}
          env:
    {{- if .Values.tls.existingCASecretName }}
            - name: SSL_CERT_FILE
              value: /etc/teleport-tls-ca/ca.pem
    {{- end }}
    {{- if .Values.teleportClusterName }}
            - name: KUBERNETES_TOKEN_PATH
              value: /var/run/secrets/teleport/serviceaccount/token
    {{- end }}
  {{- end }}
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 10
          ports:
            - name: op-metrics
              containerPort: 8080
              protocol: TCP
            - name: op-health
              containerPort: 8081
              protocol: TCP
  {{- if .Values.securityContext }}
          securityContext: {{- toYaml .Values.securityContext | nindent 12 }}
  {{- end }}
  {{- if .Values.resources }}
          resources: {{- toYaml .Values.resources | nindent 12 }}
  {{- end }}
          volumeMounts:
          - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
            name: operator-serviceaccount-token
            readOnly: true
  {{- if .Values.teleportClusterName }}
          - mountPath: /var/run/secrets/teleport/serviceaccount
            name: bot-serviceaccount-token
            readOnly: true
  {{- end }}
  {{- if .Values.tls.existingCASecretName }}
          - mountPath: /etc/teleport-tls-ca
            name: "teleport-tls-ca"
            readOnly: true
  {{- end }}
      automountServiceAccountToken: false
      volumes:
        # This projected token volume mimics the `automountServiceAccountToken`
        # behaviour but defaults to a 1h TTL instead of 1y.
        - name: operator-serviceaccount-token
          projected:
            sources:
              - serviceAccountToken:
                  path: token
              - configMap:
                  items:
                    - key: ca.crt
                      path: ca.crt
                  name: kube-root-ca.crt
              - downwardAPI:
                  items:
                    - path: "namespace"
                      fieldRef:
                        fieldPath: metadata.namespace
  {{- if .Values.teleportClusterName }}
        - name: bot-serviceaccount-token
          projected:
            sources:
              - serviceAccountToken:
                  path: token
                  audience: "{{ .Values.teleportClusterName }}"
                  expirationSeconds: 600
              - configMap:
                  items:
                    - key: ca.crt
                      path: ca.crt
                  name: kube-root-ca.crt
              - downwardAPI:
                  items:
                    - path: "namespace"
                      fieldRef:
                        fieldPath: metadata.namespace
  {{- end }}
  {{- if .Values.tls.existingCASecretName }}
        - name: teleport-tls-ca
          secret:
            secretName: {{ .Values.tls.existingCASecretName }}
  {{- end }}
  {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
  {{- end }}
  {{- if .Values.podSecurityContext }}
      securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }}
  {{- end }}
      serviceAccountName: {{ include "teleport-cluster.operator.serviceAccountName" . }}
{{- end }}
