{{/*
  Copyright 2020 NVIDIA

  Licensed under the Apache License, Version 2.0 (the "License");
  you may not use this file except in compliance with the License.
  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
*/}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "network-operator.fullname" . }}
  labels:
    {{- include "network-operator.labels" . | nindent 4 }}
    control-plane: {{ .Release.Name }}-controller
  namespace: {{ .Release.Namespace }}
spec:
  replicas: 1
  selector:
    matchLabels:
      {{- include "network-operator.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: {{ .Chart.Name }}
      labels:
        nvidia.com/ofed-driver-upgrade-drain.skip: "true"
        control-plane: {{ .Release.Name }}-controller
        {{- include "network-operator.selectorLabels" . | nindent 8 }}
    spec:
      {{- with .Values.operator.nodeSelector }}
      nodeSelector:
      {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.operator.affinity}}
      affinity:
      {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.operator.tolerations }}
      tolerations:
      {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "network-operator.fullname" . }}
      imagePullSecrets: {{ include "network-operator.operator.imagePullSecrets" . }}
      containers:
        - name: {{ .Chart.Name }}
          # Replace this with the built image name
          image: "{{ .Values.operator.repository }}/{{ .Values.operator.image }}:{{ .Values.operator.tag | default .Chart.AppVersion }}"
          {{- if .Values.operator.admissionController.enabled }}
          ports:
          - containerPort: 9443
            name: webhook-server
            protocol: TCP
          volumeMounts:
          - mountPath: /tmp/k8s-webhook-server/serving-certs
            name: cert
            readOnly: true
          {{- end }}
          command:
          - /manager
          args:
          - --leader-elect
          env:
            - name: STATE_MANIFEST_BASE_DIR
              value: "/manifests"
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: OPERATOR_NAME
              value: "network-operator"
            - name: ENABLE_WEBHOOKS
              value: "{{ .Values.operator.admissionController.enabled }}"
            - name: USE_DTK
              value: "{{ .Values.operator.useDTK }}"
            {{- if .Values.operator.cniBinDirectory }}
            - name: CNI_BIN_DIR
              value: "{{ .Values.operator.cniBinDirectory }}"
            {{- end }}
            {{- if and .Values.operator.ofedDriver.initContainer .Values.operator.ofedDriver.initContainer.enable }}
            - name: OFED_INIT_CONTAINER_IMAGE
              {{- with .Values.operator.ofedDriver.initContainer }}
              value: "{{ .repository }}/{{ .image }}:{{ .version }}"
              {{- end }}
            {{- end }}
          securityContext:
            allowPrivilegeEscalation: false
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 10
          {{- with .Values.operator.resources }}
          resources:
          {{- toYaml . | nindent 12 }}
          {{- end }}
      securityContext:
        runAsUser: 65532
      terminationGracePeriodSeconds: 10
      {{- if .Values.operator.admissionController.enabled }}
      volumes:
      - name: cert
        secret:
          defaultMode: 420
          secretName: webhook-server-cert
      {{- end }}