---
apiVersion: v1
kind: Deployment
metadata:
  name: "{{ ansible_operator_meta.name }}-web"
  namespace: "{{ ansible_operator_meta.namespace }}"
  annotations:
    email: pulp-dev@redhat.com
  labels:
    app.kubernetes.io/name: 'nginx'
    app.kubernetes.io/instance: 'nginx-{{ ansible_operator_meta.name }}'
    app.kubernetes.io/component: webserver
    app.kubernetes.io/part-of: '{{ deployment_type }}'
    app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
    owner: pulp-dev
spec:
  replicas: {{ web.replicas }}
  selector:
    matchLabels:
      app.kubernetes.io/name: 'nginx'
      app.kubernetes.io/instance: 'nginx-{{ ansible_operator_meta.name }}'
      app.kubernetes.io/component: webserver
      app.kubernetes.io/part-of: '{{ deployment_type }}'
      app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
  template:
    metadata:
      labels:
        app.kubernetes.io/name: 'nginx'
        app.kubernetes.io/instance: 'nginx-{{ ansible_operator_meta.name }}'
        app.kubernetes.io/component: webserver
        app.kubernetes.io/part-of: '{{ deployment_type }}'
        app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
    spec:
{% if image_pull_secret %}
      imagePullSecrets:
        - name: {{ image_pull_secret }}
{% endif %}
{% if affinity is defined and affinity.node_affinity is defined %}
      affinity:
        nodeAffinity: {{ affinity.node_affinity }}
{% endif %}
      serviceAccountName: '{{ ansible_operator_meta.name }}'
      containers:
        - name: web
          image: "{{ _image_web }}"
          imagePullPolicy: "{{ image_pull_policy }}"
{% if ingress_type | lower == 'nodeport' %}
          env:
            - name: NODE_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
{% endif %}
          volumeMounts:
            - name: {{ ansible_operator_meta.name }}-nginx-conf
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
              readOnly: true
{% if ingress_type | lower == 'route' and route_tls_termination_mechanism | lower == 'passthrough' %}
            - name: "{{ ansible_operator_meta.name }}-nginx-certs"
              mountPath: "/etc/nginx/pki"
              readOnly: true
{% endif %}
          ports:
            - protocol: TCP
              containerPort: 8080
{% if ingress_type | lower == 'route' and route_tls_termination_mechanism | lower == 'passthrough' %}
            - containerPort: 8443
{% endif %}
          livenessProbe:
            httpGet:
              path: pulp/api/v3/status/
{% if ingress_type | lower == 'route' and route_tls_termination_mechanism | lower == 'passthrough' %}
              port: 8443
              scheme: HTTPS
{% else %}
              port: 8080
              scheme: HTTP
{% endif %}
            failureThreshold: 5
            initialDelaySeconds: 90
            periodSeconds: 10
            timeoutSeconds: 10
          readinessProbe:
            httpGet:
              path: pulp/api/v3/status/
{% if ingress_type | lower == 'route' and route_tls_termination_mechanism | lower == 'passthrough' %}
              port: 8443
              scheme: HTTPS
{% else %}
              port: 8080
              scheme: HTTP
{% endif %}
            failureThreshold: 10
            initialDelaySeconds: 60
            periodSeconds: 10
            timeoutSeconds: 10
{% if web.resource_requirements is defined %}
          resources: {{ web.resource_requirements }}
{% endif %}
      volumes:
        - name: {{ ansible_operator_meta.name }}-nginx-conf
          configMap:
            name: '{{ ansible_operator_meta.name }}-{{ deployment_type }}-configmap'
            items:
              - key: nginx_conf
                path: nginx.conf
{% if ingress_type | lower == 'route' and route_tls_termination_mechanism | lower == 'passthrough' %}
        - name: "{{ ansible_operator_meta.name }}-nginx-certs"
          secret:
            secretName: "{{ route_tls_secret }}"
            items:
              - key: tls.key
                path: 'web.key'
              - key: tls.crt
                path: 'web.crt'
{% endif %}
