---
apiVersion: v1
kind: Deployment
metadata:
  name: "{{ ansible_operator_meta.name }}-worker"
  namespace: "{{ project_name }}"
  labels:
    app.kubernetes.io/name: '{{ deployment_type }}-worker'
    app.kubernetes.io/instance: '{{ deployment_type }}-worker-{{ ansible_operator_meta.name }}'
    app.kubernetes.io/component: worker
    app.kubernetes.io/part-of: '{{ deployment_type }}'
    app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
spec:
  replicas: {{ worker.replicas }}
  selector:
    matchLabels:
      app.kubernetes.io/name: '{{ deployment_type }}-worker'
      app.kubernetes.io/instance: '{{ deployment_type }}-worker-{{ ansible_operator_meta.name }}'
      app.kubernetes.io/component: worker
      app.kubernetes.io/part-of: '{{ deployment_type }}'
      app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
  template:
    metadata:
      labels:
        app.kubernetes.io/name: '{{ deployment_type }}-worker'
        app.kubernetes.io/instance: '{{ deployment_type }}-worker-{{ ansible_operator_meta.name }}'
        app.kubernetes.io/component: worker
        app.kubernetes.io/part-of: '{{ deployment_type }}'
        app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
    spec:
{% if image_pull_secret %}
      imagePullSecrets:
        - name: {{ image_pull_secret }}
{% endif %}
{% if affinity is defined and affinity.node_affinity is defined %}
      affinity:
        nodeAffinity: {{ affinity.node_affinity }}
{% endif %}
{% if is_k8s %}
      securityContext:
        runAsUser: 0
        fsGroup: 0
{% endif %}
      volumes:
        - name: {{ ansible_operator_meta.name }}-server
          secret:
            secretName: {{ ansible_operator_meta.name }}-server
            items:
              - path: settings.py
                key: settings.py
        - name: {{ ansible_operator_meta.name }}-db-fields-encryption
          secret:
            secretName: {{ db_fields_encryption_secret }}
            items:
              - path: database_fields.symmetric.key
                key: database_fields.symmetric.key
{% if is_file_storage %}
        - name: file-storage
          persistentVolumeClaim:
            claimName: {{ ansible_operator_meta.name }}-file-storage
{% else %}
        - name: tmp-file-storage
          emptyDir: {}
{% endif %}
        - name: {{ ansible_operator_meta.name }}-ansible-tmp
          emptyDir: {}
      containers:
        - name: worker
          image: "{{ registry }}/{{ project }}/{{ image }}:{{ tag }}"
          imagePullPolicy: "{{ image_pull_policy }}"
          # We set args, not command, so as to not override the entrypoint script
          args: ["pulp-worker"]
          env:
            - name: POSTGRES_SERVICE_HOST
              value: "{{ postgres_host }}"
            - name: POSTGRES_SERVICE_PORT
              value: "{{ postgres_port }}"
            - name: REDIS_SERVICE_HOST
              value: "{{ ansible_operator_meta.name }}-redis"
            - name: REDIS_SERVICE_PORT
              value: "{{ default_settings.redis_port }}"
          volumeMounts:
            - name: {{ ansible_operator_meta.name }}-ansible-tmp
              mountPath: "/.ansible/tmp/"
            - name: {{ ansible_operator_meta.name }}-server
              mountPath: "/etc/pulp/"
            - name: {{ ansible_operator_meta.name }}-db-fields-encryption
              mountPath: "/etc/pulp/keys/"
              readOnly: true
{% if is_file_storage %}
            - name: file-storage
              readOnly: false
              mountPath: "/var/lib/pulp"
{% else %}
            - name: tmp-file-storage
              mountPath: "/var/lib/pulp/tmp"
{% endif %}
{% if worker.resource_requirements is defined %}
          resources: {{ worker.resource_requirements }}
{% endif %}
