apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "telegraf-operator.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "telegraf-operator.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "telegraf-operator.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "telegraf-operator.selectorLabels" . | nindent 8 }}
{{- if eq .Values.certManager.enable false }}
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/tls.yml") . | sha256sum }}
{{- end }}
    spec:
      containers:
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: "{{ .Values.image.repository }}:{{ .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          args:
            - "--telegraf-default-class={{ .Values.classes.default }}"
            - --telegraf-classes-directory=/etc/telegraf-operator
            - --enable-default-internal-plugin
            - "--telegraf-image={{ .Values.image.sidecarImage }}"
            {{- if eq .Values.requireAnnotationsForSecret true }}
            - "--require-annotations-for-secret"
            {{- end }}
            - "--telegraf-requests-cpu={{ .Values.sidecarResources.requests.cpu }}"
            - "--telegraf-requests-memory={{ .Values.sidecarResources.requests.memory }}"
            - "--telegraf-limits-cpu={{ .Values.sidecarResources.limits.cpu }}"
            - "--telegraf-limits-memory={{ .Values.sidecarResources.limits.memory }}"
            {{- if eq .Values.hotReload true }}
            - "--telegraf-watch-config=inotify"
            {{- end }}
          env:
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          ports:
            - name: https
              containerPort: 9443
              protocol: TCP
          volumeMounts:
            - mountPath: /etc/certs
              name: certs
              readOnly: true
            - mountPath: /etc/telegraf-operator
              name: classes
              readOnly: true
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "telegraf-operator.fullname" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      volumes:
      - name: certs
        secret:
          secretName: telegraf-operator-tls
      - name: classes
        secret:
          secretName: {{ .Values.classes.secretName }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
    {{- end }}