apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "kubeapps.fullname" . }}
  labels:{{ include "kubeapps.extraAppLabels" . | nindent 4 }}
    app: {{ template "kubeapps.fullname" . }}
spec:
  replicas: {{ .Values.frontend.replicaCount }}
  selector:
    matchLabels:
      app: {{ template "kubeapps.fullname" . }}
      release: {{ .Release.Name }}
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/kubeapps-frontend-config.yaml") . | sha256sum }}
      labels:
        app: {{ template "kubeapps.fullname" . }}
        app.kubernetes.io/name: {{ template "kubeapps.name" . }}
        release: {{ .Release.Name }}
        app.kubernetes.io/instance: {{ .Release.Name }}
    spec:
{{- include "kubeapps.imagePullSecrets" . | indent 6 }}
      {{- if .Values.frontend.affinity }}
      affinity: {{- include "kubeapps.tplValue" (dict "value" .Values.frontend.affinity "context" $) | nindent 8 }}
      {{- end }}
      {{- if .Values.frontend.nodeSelector }}
      nodeSelector: {{- include "kubeapps.tplValue" (dict "value" .Values.frontend.nodeSelector "context" $) | nindent 8 }}
      {{- end }}
      {{- if .Values.frontend.tolerations }}
      tolerations: {{- include "kubeapps.tplValue" (dict "value" .Values.frontend.tolerations "context" $) | nindent 8 }}
      {{- end }}
      {{- if .Values.securityContext.enabled }}
      securityContext:
        fsGroup: {{ .Values.securityContext.fsGroup }}
        runAsUser: {{ .Values.securityContext.runAsUser }}
      {{- end }}
      containers:
        - name: nginx
          image: {{ template "kubeapps.image" (list .Values.frontend.image .Values.global) }}
          imagePullPolicy: {{ .Values.frontend.image.pullPolicy | quote }}
          {{- if .Values.frontend.livenessProbe }}
          livenessProbe: {{- toYaml .Values.frontend.livenessProbe | nindent 12 }}
          {{- end }}
          {{- if .Values.frontend.readinessProbe }}
          readinessProbe: {{- toYaml .Values.frontend.readinessProbe | nindent 12 }}
          {{- end }}
          volumeMounts:
            - name: vhost
              mountPath: /opt/bitnami/nginx/conf/server_blocks
          ports:
            - name: http
              containerPort: 8080
          {{- if .Values.frontend.resources }}
          resources: {{- toYaml .Values.frontend.resources | nindent 12 }}
          {{- end }}
        {{- if and .Values.authProxy.enabled (not .Values.authProxy.external) }}
        - name: auth-proxy
          args:
            - --provider={{ required "You must fill \".Values.authProxy.provider\" with the provider. Valid values at https://pusher.github.io/oauth2_proxy/auth-configuration" .Values.authProxy.provider }}
            - --client-id={{ required "You must fill \".Values.authProxy.clientID\" with the Client ID of the provider" .Values.authProxy.clientID }}
            - --client-secret={{ required "You must fill \".Values.authProxy.clientSecret\" with the Client Secret of the provider" .Values.authProxy.clientSecret }}
            - --cookie-secret={{ required "You must fill \".Values.authProxy.cookieSecret\" with a 16, 24 or 32 byte base64 encoded seed string for secure cookies" .Values.authProxy.cookieSecret }}
            - --upstream=http://localhost:8080/
            - --http-address=0.0.0.0:3000
            - --email-domain={{ .Values.authProxy.emailDomain }}
            - --pass-basic-auth=false
            - --pass-access-token=true
            - --pass-authorization-header=true
            - --skip-auth-regex=^\/config\.json$
            - --skip-auth-regex=^\/favicon.*\.png$
            - --skip-auth-regex=^\/static\/
            - --skip-auth-regex=^\/$
            - --scope=openid email groups
            {{- range .Values.authProxy.additionalFlags }}
            - {{ . }}
            {{- end }}
          image: {{ template "kubeapps.image" (list .Values.authProxy.image .Values.global) }}
          imagePullPolicy: {{ .Values.authProxy.image.pullPolicy | quote }}
          ports:
            - name: proxy
              containerPort: 3000
          {{- if .Values.authProxy.resources }}
          resources: {{- toYaml .Values.authProxy.resources | nindent 12 }}
          {{- end }}
        {{- end }}
        {{- if and (gt (len .Values.clusters) 1) (not .Values.authProxy.enabled) }}
          {{ fail "clusters can be configured only when using an auth proxy for cluster oidc authentication."}}
        {{- end }}
      volumes:
        - name: vhost
          configMap:
            name: {{ template "kubeapps.frontend-config.fullname" . }}
