{{- if and .Values.kustomizeController.create }}
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: {{ .Release.Namespace | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
    app.kubernetes.io/version: {{ .Chart.AppVersion | quote  }}
    app.kubernetes.io/part-of: flux
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
    control-plane: controller
    {{- with .Values.kustomizeController.labels }}
    {{- . | toYaml | nindent 4 }}
    {{- end }}
  name: kustomize-controller
spec:
  {{- if kindIs "invalid" .Values.kustomizeController.replicas }}
  replicas: 1
  {{- else }}
  replicas: {{ .Values.kustomizeController.replicas  }}
  {{- end}}
  selector:
    matchLabels:
      app: kustomize-controller
  template:
    metadata:
      {{- with .Values.kustomizeController.annotations }}
      annotations: {{ toYaml . | nindent 8 }}
      {{- end }}
      labels:
        app: kustomize-controller
{{ with .Values.kustomizeController.labels }}{{ toYaml . | indent 8 }}{{ end }}
    spec:
      automountServiceAccountToken: {{ .Values.kustomizeController.serviceAccount.automount }}
      {{- if .Values.kustomizeController.initContainers}}
      initContainers:
        {{- toYaml .Values.kustomizeController.initContainers | nindent 8}}
      {{- end}}
      containers:
      - args:
        {{- if .Values.multitenancy.enabled }}
        - --no-cross-namespace-refs=true
        - --default-service-account={{ .Values.multitenancy.defaultServiceAccount | default "default"  }}
        {{- end}}
        {{- if .Values.notificationController.create }}
        - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.{{ .Values.clusterDomain | default "cluster.local" }}.
        {{- end}}
        - --watch-all-namespaces={{ .Values.watchAllNamespaces }}
        - --log-level={{ .Values.logLevel | default "info" }}
        - --log-encoding=json
        - --enable-leader-election
        {{- range .Values.kustomizeController.container.additionalArgs }}
        - {{ . }}
        {{- end}}
        env:
        - name: RUNTIME_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        {{- with .Values.kustomizeController.extraEnv }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- if or (.Values.kustomizeController.envFrom.map.name) (.Values.kustomizeController.envFrom.secret.name) }}
        envFrom:
          {{- if .Values.kustomizeController.envFrom.map.name }}
          - configMapRef:
              name: {{ .Values.kustomizeController.envFrom.map.name }}
          {{- end }}
          {{- if .Values.kustomizeController.envFrom.secret.name }}
          - secretRef:
              name: {{ .Values.kustomizeController.envFrom.secret.name }}
          {{- end }}
        {{- end }}
        image: {{ template "template.image" .Values.kustomizeController }}
        {{- if .Values.kustomizeController.imagePullPolicy }}
        imagePullPolicy: {{ .Values.kustomizeController.imagePullPolicy }}
        {{- else }}
        imagePullPolicy: IfNotPresent
        {{- end }}
        livenessProbe:
          httpGet:
            path: /healthz
            port: healthz
        name: manager
        ports:
        - containerPort: 8080
          name: http-prom
        - containerPort: 9440
          name: healthz
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /readyz
            port: healthz
        {{- with .Values.kustomizeController.resources }}
        resources: {{ toYaml . | nindent 10 }}
        {{- end }}
        {{- if .Values.kustomizeController.securityContext }}
        securityContext: {{ toYaml .Values.kustomizeController.securityContext | nindent 10 }}
        {{- else }}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
        {{- end}}
        volumeMounts:
        - mountPath: /tmp
          name: temp
        {{- if .Values.kustomizeController.volumeMounts }}
        {{- toYaml .Values.kustomizeController.volumeMounts | nindent 8 }}
        {{- end}}
      {{- if .Values.kustomizeController.priorityClassName }}
      priorityClassName: {{ .Values.kustomizeController.priorityClassName | quote }}
      {{- end }}
      {{- range .Values.kustomizeController.extraSecretMounts }}
        - name: {{ .name }}
          mountPath: {{ .mountPath }}
          subPath: {{ .subPath }}
          readOnly: {{ .readOnly }}
      {{- end }}
      {{- if .Values.kustomizeController.podSecurityContext }}
      securityContext: {{ toYaml .Values.kustomizeController.podSecurityContext | nindent 8 }}
      {{- else }}
      securityContext:
        fsGroup: 1337
      {{- end}}
      serviceAccountName: kustomize-controller
      {{- if .Values.imagePullSecrets }}
      imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 6 }}
      {{- end }}
      terminationGracePeriodSeconds: 60
      volumes:
      - emptyDir: {}
        name: temp
      {{- if .Values.kustomizeController.volumes }}
      {{- toYaml .Values.kustomizeController.volumes | nindent 6 }}
      {{- end}}
      {{- range .Values.kustomizeController.extraSecretMounts }}
      - name: {{ .name }}
        secret:
          secretName: {{ .secretName }}
      {{- end }}
      {{- with .Values.kustomizeController.nodeSelector }}
      nodeSelector: {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.kustomizeController.affinity }}
      affinity: {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.kustomizeController.tolerations }}
      tolerations: {{ toYaml . | nindent 8 }}
      {{- end }}
{{- end }}
