# helm_charts_authenticate-deployment.yaml
{{- $configName := default (include "pomerium.fullname" .) .Values.config.existingConfig }}
{{- $secretName := default (include "pomerium.fullname" .) .Values.config.existingSecret }}
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.authenticate.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: authenticate
  name: {{ template "pomerium.authenticate.fullname" . }}
  annotations:
 {{- if .Values.authenticate.deployment.annotations }}
 {{- range $key, $value := .Values.authenticate.deployment.annotations }}
   {{ $key }}: {{ $value | quote }}
 {{- end }}
{{- else if .Values.annotations }}
 {{- range $key, $value := .Values.annotations }}
   {{ $key }}: {{ $value | quote }}
 {{- end }}
{{- end }}
spec:
  replicas: {{ default .Values.replicaCount .Values.authenticate.replicaCount }}
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "pomerium.authenticate.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name }}
  template:
    metadata:
      annotations:
        {{- /* policy is already covered by hot-reloading */}}
        checksum/config: {{ print .Values.config.extraOpts | sha256sum }}
        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
{{- if .Values.podAnnotations }}
{{ toYaml .Values.podAnnotations | indent 8 }}
{{- end }}
      labels:
        app.kubernetes.io/name: {{ template "pomerium.authenticate.name" . }}
        helm.sh/chart: {{ template "pomerium.chart" . }}
        app.kubernetes.io/managed-by: {{ .Release.Service }}
        app.kubernetes.io/instance: {{ .Release.Name }}
{{- if .Values.podLabels }}
{{ toYaml .Values.podLabels | indent 8 }}
{{- end }}
    spec:
{{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
{{- end }}
      containers:
      - name: {{ .Chart.Name }}
        image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        args:
{{- if or .Values.config.existingConfig .Values.config.policy }}
          - --config=/etc/pomerium/config.yaml
{{- end }}
{{- range $key, $value := .Values.extraArgs }}
{{- if $value }}
          - --{{ $key }}={{ $value }}
{{- else }}
          - --{{ $key }}
{{- end }}
{{- end }}
        env:
        - name: SERVICES
          value: authenticate
        - name: AUTHENTICATE_SERVICE_URL
          value: {{ default (printf "https://authenticate.%s" .Values.config.rootDomain ) .Values.proxy.authenticateServiceUrl }}
        - name: COOKIE_SECRET
          valueFrom:
            secretKeyRef:
              name: {{ $secretName }}
              key: cookie-secret
        - name: SHARED_SECRET
          valueFrom:
            secretKeyRef:
              name: {{ $secretName }}
              key: shared-secret
        - name: IDP_PROVIDER
          value: {{ .Values.authenticate.idp.provider }}
        - name: IDP_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name:  {{ $secretName }}
              key: idp-client-id
        - name: IDP_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name:  {{ $secretName }}
              key: idp-client-secret
        - name: IDP_PROVIDER_URL
          value: {{ .Values.authenticate.idp.url }}
{{- if .Values.authenticate.idp.serviceAccount }}
        - name: IDP_SERVICE_ACCOUNT
          valueFrom:
            secretKeyRef:
              name:  {{ $secretName }}
              key: idp-service-account
{{- end }}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- if .Values.config.existingLegacyTLSSecret }}
        - name: CERTIFICATE
          valueFrom:
            secretKeyRef:
              name:  {{ template "pomerium.authenticate.tlsSecret.name" . }}
              key:  {{ template "pomerium.authenticate.tlsSecret.certName" . }}
        - name: CERTIFICATE_KEY
          valueFrom:
            secretKeyRef:
              name:  {{ template "pomerium.authenticate.tlsSecret.name" . }}
              key:  {{ template "pomerium.authenticate.tlsSecret.keyName" . }}
        - name: CERTIFICATE_AUTHORITY
          valueFrom:
            secretKeyRef:
              name:  {{ template "pomerium.caSecret.name" . }}
              key:  {{ template "pomerium.caSecret.certName" . }}
{{- else }}
        - name: CERTIFICATE_FILE
          value: "/pomerium/cert.pem"
        - name: CERTIFICATE_KEY_FILE
          value: "/pomerium/privkey.pem"
        - name: CERTIFICATE_AUTHORITY_FILE
          value: "/pomerium/ca.pem"
{{- end }}
{{- range $name, $value := .Values.extraEnv }}
        - name: {{ $name }}
          value: {{ quote $value }}
{{- end }}
        ports:
          - containerPort: 443
            name: https
            protocol: TCP
          - containerPort: {{ .Values.metrics.port }}
            name: metrics
            protocol: TCP
        livenessProbe:
          httpGet:
            path: /ping
            port: https
            scheme: HTTPS
        readinessProbe:
          httpGet:
            path: /ping
            port: https
            scheme: HTTPS
        resources:
{{ toYaml .Values.resources | indent 10 }}
        volumeMounts:
{{- if or .Values.config.existingConfig .Values.config.policy }}
        - mountPath: /etc/pomerium/
          name: config
{{- end }}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- if not .Values.config.existingLegacyTLSSecret }}
        - mountPath: /pomerium/cert.pem
          name: service-tls
          subPath: {{ template "pomerium.authenticate.tlsSecret.certName" . }}
        - mountPath: /pomerium/privkey.pem
          name: service-tls
          subPath: {{ template "pomerium.authenticate.tlsSecret.keyName" . }}
        - mountPath: /pomerium/ca.pem
          name: ca-tls
          subPath: {{ template "pomerium.caSecret.certName" . }}
{{- end }}
      volumes:
{{- if or .Values.config.existingConfig .Values.config.policy }}
      - name: config
        configMap:
          name: {{ $configName }}
{{- end }}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- if not .Values.config.existingLegacyTLSSecret }}
      - name: service-tls
        secret:
          secretName: {{ template "pomerium.authenticate.tlsSecret.name" . }}
      - name: ca-tls
        secret:
          secretName: {{ template "pomerium.caSecret.name" . }}
{{- end }}
{{- if .Values.extraVolumes }}
{{- toYaml .Values.extraVolumes | indent 8 }}
{{- end }}
{{- if .Values.imagePullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
{{- end }}
{{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.tolerations }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 }}
{{- end }}
{{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
{{- end }}