---
apiVersion: v1
kind: Deployment
metadata:
  name: "{{ ansible_operator_meta.name }}-api"
  namespace: "{{ ansible_operator_meta.namespace }}"
  annotations:
    email: pulp-dev@redhat.com
  labels:
    app.kubernetes.io/name: '{{ deployment_type }}-api'
    app.kubernetes.io/instance: '{{ deployment_type }}-api-{{ ansible_operator_meta.name }}'
    app.kubernetes.io/component: api
    app.kubernetes.io/part-of: '{{ deployment_type }}'
    app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
    owner: pulp-dev
spec:
  replicas: {{ api.replicas }}
  selector:
    matchLabels:
      app.kubernetes.io/name: '{{ deployment_type }}-api'
      app.kubernetes.io/instance: '{{ deployment_type }}-api-{{ ansible_operator_meta.name }}'
      app.kubernetes.io/component: api
      app.kubernetes.io/part-of: '{{ deployment_type }}'
      app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
  template:
    metadata:
      labels:
        app.kubernetes.io/name: '{{ deployment_type }}-api'
        app.kubernetes.io/instance: '{{ deployment_type }}-api-{{ ansible_operator_meta.name }}'
        app.kubernetes.io/component: api
        app.kubernetes.io/part-of: '{{ deployment_type }}'
        app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
    spec:
{% if image_pull_secret %}
      imagePullSecrets:
        - name: {{ image_pull_secret }}
{% endif %}
{% if affinity is defined and affinity.node_affinity is defined %}
      affinity:
        nodeAffinity: {{ affinity.node_affinity }}
{% endif %}
{% if is_k8s %}
      securityContext:
        runAsUser: 0
        fsGroup: 0
{% endif %}
      volumes:
        - name: {{ ansible_operator_meta.name }}-server
          secret:
            secretName: {{ ansible_operator_meta.name }}-server
            items:
              - path: settings.py
                key: settings.py
        - name: {{ ansible_operator_meta.name }}-admin-password
          secret:
            secretName: {{ admin_password_name }}
            items:
              - path: admin-password
                key: password
        - name: {{ ansible_operator_meta.name }}-db-fields-encryption
          secret:
            secretName: {{ db_fields_encryption_secret }}
            items:
              - path: database_fields.symmetric.key
                key: database_fields.symmetric.key
{% if is_file_storage %}
        - name: file-storage
          persistentVolumeClaim:
            claimName: {{ ansible_operator_meta.name }}-file-storage
{% else %}
        - name: tmp-file-storage
          emptyDir: {}
        - name: assets-file-storage
          emptyDir: {}
{% endif %}
{% if container_token_secret is defined %}
        - name: {{ ansible_operator_meta.name }}-container-auth-certs
          secret:
            secretName: {{ container_token_secret }}
            items:
              - path: container_auth_public_key.pem
                key: container_auth_public_key.pem
              - path: container_auth_private_key.pem
                key: container_auth_private_key.pem
{% endif %}
      serviceAccountName: '{{ ansible_operator_meta.name }}'
      containers:
        - name: api
          image: "{{ _image }}"
          imagePullPolicy: "{{ image_pull_policy }}"
          # We set args, not command, so as to not override the entrypoint script
          args: ["pulp-api"]
          env:
            - name: POSTGRES_SERVICE_HOST
              value: "{{ postgres_host }}"
            - name: POSTGRES_SERVICE_PORT
              value: "{{ postgres_port }}"
            - name: REDIS_SERVICE_HOST
              value: "{{ ansible_operator_meta.name }}-redis-svc"
            - name: REDIS_SERVICE_PORT
              value: "{{ default_settings.redis_port }}"
          ports:
            - protocol: TCP
              containerPort: 24817
          livenessProbe:
            httpGet:
              path: pulp/api/v3/status/
              port: 24817
              scheme: HTTP
            failureThreshold: 5
            initialDelaySeconds: 60
            periodSeconds: 10
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: pulp/api/v3/status/
              port: 24817
              scheme: HTTP
            failureThreshold: 10
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
{% if api.resource_requirements is defined %}
          resources: {{ api.resource_requirements }}
{% endif %}
          volumeMounts:
            - name: {{ ansible_operator_meta.name }}-server
              mountPath: "/etc/pulp/settings.py"
              subPath: settings.py
              readOnly: true
            - name: {{ ansible_operator_meta.name }}-admin-password
              mountPath: "/etc/pulp/pulp-admin-password"
              subPath: admin-password
              readOnly: true
            - name: {{ ansible_operator_meta.name }}-db-fields-encryption
              mountPath: "/etc/pulp/keys/database_fields.symmetric.key"
              subPath: database_fields.symmetric.key
              readOnly: true
{% if is_file_storage %}
            - name: file-storage
              readOnly: false
              mountPath: "/var/lib/pulp"
{% else %}
            - name: tmp-file-storage
              mountPath: "/var/lib/pulp/tmp"
            - name: assets-file-storage
              mountPath: "/var/lib/pulp/assets"
{% endif %}
{% if container_token_secret is defined %}
            - name: {{ ansible_operator_meta.name }}-container-auth-certs
              mountPath: "/etc/pulp/keys/container_auth_private_key.pem"
              subPath: container_auth_private_key.pem
              readOnly: true
            - name: {{ ansible_operator_meta.name }}-container-auth-certs
              mountPath: "/etc/pulp/keys/container_auth_public_key.pem"
              subPath: container_auth_public_key.pem
              readOnly: true
{% endif %}
