{{- define "traffic-manager-env" }}
          - name: SYSTEMA_HOST
            value: {{ .systemaHost }}
          - name: SYSTEMA_PORT
            value: {{ .systemaPort | quote }}
          - name: INTERCEPT_DISABLE_GLOBAL
            value: {{ quote (default false .intercept.disableGlobal) }}
  {{- with .agent.envoy }}
    {{- if .logLevel }}
          - name: AGENT_ENVOY_LOG_LEVEL
            value: {{ .logLevel }}
    {{- end }}
    {{- if .serverPort }}
          - name: AGENT_ENVOY_SERVER_PORT
            value: {{ .serverPort | quote }}
    {{- end }}
    {{- if .adminPort }}
          - name: AGENT_ENVOY_ADMIN_PORT
            value: {{ .adminPort | quote }}
    {{- end }}
    {{- if .httpIdleTimeout }}
          - name: AGENT_ENVOY_HTTP_IDLE_TIMEOUT
            value: {{ .httpIdleTimeout }}
    {{- end }}
  {{- end }}
{{- end }}
{{- define "traffic-manager-mounts" }}
  {{- if .licenseKey.create }}
          - name: license
            mountPath: /home/telepresence
            readOnly: true
  {{- end }}
  {{- if .httpsProxy.rootCATLSSecret }}
          - name: proxy-ca
            mountPath: /var/run/secrets/proxy_tls
            readOnly: true
  {{- end }}
{{- end }}
{{- define "traffic-manager-vols" }}
  {{- if .licenseKey.create }}
      - name: license
        secret:
          defaultMode: 420
          secretName: {{ .licenseKey.secret.name }}
  {{- end }}
  {{- if .httpsProxy.rootCATLSSecret }}
      - name: proxy-ca
        secret:
          defaultMode: 420
          secretName: {{ .httpsProxy.rootCATLSSecret }}
  {{- end }}
{{- end }}
{{- /* verify that we either have access to Ambassador Cloud or have a agent.image defined */}}
{{- with .Values }}
  {{- if not (or (and .systemaHost .systemaPort) (and .agent.image.name .agent.image.tag) (and .agentInjector.agentImage.name .agentInjector.agentImage.tag)) }}
    {{- fail "Either systemaHost and systemaPort or agent.image.name and agent.image.tag must be defined" }}
  {{- end }}
{{- end }}
{{- with .Values }}
{{- if not .rbac.only }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "traffic-manager.name" $ }}
  namespace: {{ include "traffic-manager.namespace" $ }}
  labels:
    {{- include "telepresence.labels" $ | nindent 4 }}
spec:
  replicas: {{ .replicaCount }}
  selector:
    matchLabels:
      {{- include "telepresence.selectorLabels" $ | nindent 6 }}
  template:
    metadata:
    {{- with .podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
    {{- end }}
      labels:
        {{- include "telepresence.selectorLabels" $ | nindent 8 }}
    {{- with .podLabels }}
        {{- toYaml . | nindent 8 }}
    {{- end }}
    spec:
      {{- with .image.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      securityContext:
        {{- toYaml .podSecurityContext | nindent 8 }}
      containers:
        - name: {{ include "traffic-manager.name" $ }}
          securityContext:
            {{- toYaml .securityContext | nindent 12 }}
          {{- with .image }}
          image: "{{ .registry }}/{{ .name }}:{{ .tag | default $.Chart.AppVersion }}"
          imagePullPolicy: {{ .pullPolicy }}
          {{- end }}
          env:
          - name: LOG_LEVEL
            value: {{ .logLevel }}
          - name: SERVER_PORT
            value: {{ .apiPort | quote }}
          - name: POD_CIDR_STRATEGY
            value: {{ .podCIDRStrategy }}
          {{- with .podCIDRs }}
          - name: POD_CIDRS
            value: "{{ join " " . }}"
          {{- end }}
          - name: MUTATOR_WEBHOOK_PORT
            value: {{ .agentInjector.webhook.port | quote }}
          {{- with .tracing }}
          {{- if .grpcPort }}
          - name: TRACING_GRPC_PORT
            value: {{ .grpcPort | quote }}
          {{- end }}
          {{- end }}
          {{- with .telepresenceAPI }}
          {{- if .port }}
          - name: AGENT_REST_API_PORT
            value: {{ .port | quote }}
          {{- end }}
          {{- end }}
          {{- if .grpc }}
          {{- if .grpc.maxReceiveSize }}
          - name: GRPC_MAX_RECEIVE_SIZE
            value: {{ .grpc.maxReceiveSize }}
          {{- end }}
          {{- end }}
          - name: AGENT_ARRIVAL_TIMEOUT
            value: {{ quote (default "30s" .timeouts.agentArrival) }}
        {{- /*
        Traffic agent injector configuration
        */}}
          {{- with .agentInjector }}
          - name: AGENT_INJECT_POLICY
            value: {{ .injectPolicy }}
          - name: AGENT_INJECTOR_NAME
            value:  {{ .name | quote }}
          {{- end }}
        {{- /*
        Traffic agent configuration
        */}}
          {{- if .agent.logLevel }}
          - name: AGENT_LOG_LEVEL
            value: {{ .agent.logLevel }}
          {{- end }}
          {{- if .agent.port }}
          - name: AGENT_PORT
            value: {{ .agent.port | quote }}
          {{- end }}
          {{- /* replaced by agent.appProtocolStrategy. Retained for backward compatibility */}}
          {{- if $.Values.agentInjector.appProtocolStrategy }}
          - name: AGENT_APP_PROTO_STRATEGY
            value: {{ $.Values.agentInjector.appProtocolStrategy }}
          {{- else }}
          {{- if .agent.appProtocolStrategy }}
          - name: AGENT_APP_PROTO_STRATEGY
            value: {{ .agent.appProtocolStrategy }}
          {{- end }}
          {{- end }}
          {{- /* replaced by agent.resources. Retained for backward compatibility */}}
          {{- if $.Values.agentInjector.agentImage.resources }}
          - name: AGENT_RESOURCES
            value: '{{ toJson $.Values.agentInjector.agentImage.resources }}'
          {{- else }}
          {{- if .agent.resources }}
          - name: AGENT_RESOURCES
            value: '{{ toJson .agent.resources }}'
          {{- end }}
          {{- end }}
          {{- /* replaced by agent.initResoruces. Retained for backward compatibility */}}
          {{- if $.Values.agentInjector.agentImage.initResources }}
          - name: AGENT_INIT_RESOURCES
            value: '{{ toJson $.Values.agentInjector.agentImage.initResources }}'
          {{- else }}
          {{- if .agent.initResources }}
          - name: AGENT_INIT_RESOURCES
            value: '{{ toJson .agent.initResources }}'
          {{- end }}
          {{- end }}
          {{- /* replaced by agent.image.name Retained for backward compatibility */}}
          {{- if $.Values.agentInjector.agentImage.name }}
          - name: AGENT_IMAGE
            value: "{{ $.Values.agentInjector.agentImage.name }}:{{ $.Values.agentInjector.agentImage.tag | default $.Chart.AppVersion }}"
          {{- else }}
          {{- if .agent.image.name }}
          - name: AGENT_IMAGE
            value: "{{ .agent.image.name }}:{{ .agent.image.tag | default $.Chart.AppVersion }}"
          {{- end }}
          {{- end }}
          {{- /* replaced by agent.image.registry Retained for backward compatibility */}}
          {{- if $.Values.agentInjector.agentImage.registry }}
          - name: AGENT_REGISTRY
            value: {{ $.Values.agentInjector.agentImage.registry }}
          {{- else }}
          {{- if .agent.image.registry }}
          - name: AGENT_REGISTRY
            value: {{ .agent.image.registry }}
          {{- end }}
          {{- end }}
          {{- with .agent.image.pullSecrets }}
          - name: AGENT_IMAGE_PULL_SECRETS
            value: '{{ toJson . }}'
          {{- end }}
          - name: AGENT_IMAGE_PULL_POLICY
            value: {{ .agent.image.pullPolicy }}
          {{- if .prometheus.port }}  # 0 is false
          - name: PROMETHEUS_PORT
            value: "{{ .prometheus.port }}"
          {{- end }}
          - name: MANAGER_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: POD_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP
          {{- if .managerRbac.namespaced }}
          {{- with .managerRbac.namespaces }}
          - name: MANAGED_NAMESPACES
            value: "{{ join " " . }}"
          {{- end }}
          {{- end }}
        {{- /*
        Client configuration
        */}}
          {{- with .client }}
          - name: CLIENT_CONNECTION_TTL
            value: {{ .connectionTTL }}
          {{- /* replaced by client.routing. Retained for backward compatibility */}}
          {{- with $.Values.dnsConfig }}
          {{- if .alsoProxySubnets }}
          - name: CLIENT_ROUTING_ALSO_PROXY_SUBNETS
            value: "{{ join " " .alsoProxySubnets }}"
          {{- end }}
          {{- if .neverProxySubnets }}
          - name: CLIENT_ROUTING_NEVER_PROXY_SUBNETS
            value: "{{ join " " .neverProxySubnets }}"
          {{- end }}
          {{- else }}
          {{- with .routing }}
          {{- if .alsoProxySubnets }}
          - name: CLIENT_ROUTING_ALSO_PROXY_SUBNETS
            value: "{{ join " " .alsoProxySubnets }}"
          {{- end }}
          {{- if .neverProxySubnets }}
          - name: CLIENT_ROUTING_NEVER_PROXY_SUBNETS
            value: "{{ join " " .neverProxySubnets }}"
          {{- end }}
          {{- if .allowConflictingSubnets }}
          - name: CLIENT_ROUTING_ALLOW_CONFLICTING_SUBNETS
            value: "{{ join " " .allowConflictingSubnets }}"
          {{- end }}
          {{- end }}
          {{- end }}
          {{- with .dns }}
          {{- with .excludeSuffixes }}
          - name: CLIENT_DNS_EXCLUDE_SUFFIXES
            value: "{{ join " " . }}"
          {{- end }}
          {{- with .includeSuffixes }}
          - name: CLIENT_DNS_INCLUDE_SUFFIXES
            value: "{{ join " " . }}"
          {{- end }}
          {{- end }}
          {{- end }}
        {{- if and .trafficManager .trafficManager.envTemplate }}
          {{- template "traffic-manager-env" . }}
        {{- end }}
          ports:
          - name: api
            containerPort: {{ .apiPort }}
          - name: https
            containerPort: {{ .agentInjector.webhook.port }}
          {{- if .prometheus.port }}  # 0 is false
          - name: prometheus
            containerPort: {{ .prometheus.port }}
          {{- end }}
          {{- with .tracing }}
          - name: grpc-trace
            containerPort: {{ .grpcPort }}
          {{- end }}
          {{- with .livenessProbe }}
          livenessProbe:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with .readinessProbe }}
          readinessProbe:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with .resources }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          volumeMounts:
          - name: tls
            mountPath: /var/run/secrets/tls
            readOnly: true
        {{- if and .trafficManager .trafficManager.mountsTemplate }}
          {{- template "traffic-manager-mounts" . }}
        {{- end }}
      {{- with .nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .priorityClassName }}
      priorityClassName: {{ . | quote }}
      {{- end }}
      volumes:
      - name: tls
        secret:
          defaultMode: 420
          secretName: {{ .agentInjector.secret.name }}
    {{- if and .trafficManager .trafficManager.volsTemplate }}
      {{- template "traffic-manager-vols" . }}
    {{- end }}
      serviceAccount: traffic-manager
      serviceAccountName: traffic-manager
{{- end }}
{{- end }}
