---

{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "vela-rollout.serviceAccountName" . }}
  labels:
    {{- include "vela-rollout.labels" . | nindent 4 }}
  {{- with .Values.serviceAccount.annotations }}
  annotations:
  {{- toYaml . | nindent 4 }}
  {{- end }}
{{- end }}

---
# runtime controller need minimal authority
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "vela-rollout.fullname" . }}:rollout-role
rules:
  - apiGroups:
      - "core.oam.dev"
    resources:
      - resourcetrackers
      - resourcetrackers/status
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - "standard.oam.dev"
    resources:
      - rollouts
      - rollouts/status
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - "apps"
    resources:
      - statefulsets
      - statefulsets/status
      - deployments
      - deployments/status
      - controllerrevisions
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - "apps.kruise.io"
    resources:
      - clonesets
      - clonesets/status
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "vela-rollout.fullname" . }}:rollout-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include "vela-rollout.fullname" . }}:rollout-role
subjects:
  - kind: ServiceAccount
    name: {{ include "vela-rollout.serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}

---
# permissions to do leader election.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "vela-rollout.fullname" . }}:leader-election-role
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - ""
    resources:
      - configmaps/status
    verbs:
      - get
      - update
      - patch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "vela-rollout.fullname" . }}:leader-election-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include "vela-rollout.fullname" . }}:leader-election-role
subjects:
  - kind: ServiceAccount
    name: {{ include "vela-rollout.serviceAccountName" . }}

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "vela-rollout.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
  {{- include "vela-rollout.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
  {{- include "vela-rollout.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
    {{- include "vela-rollout.selectorLabels" . | nindent 8 }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
      {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "vela-rollout.serviceAccountName" . }}
      securityContext:
      {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
        - name: {{ .Release.Name }}
          securityContext:
          {{- toYaml .Values.securityContext | nindent 12 }}
          args:
            - "--enable-leader-election"
            - "--health-addr=:{{ .Values.healthCheck.port }}"
          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
          imagePullPolicy: {{ quote .Values.image.pullPolicy }}
          resources:
          {{- toYaml .Values.resources | nindent 12 }}
          ports:
            - containerPort: {{ .Values.healthCheck.port }}
              name: healthz
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /readyz
              port: healthz
            initialDelaySeconds: 90
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /healthz
              port: healthz
            initialDelaySeconds: 90
            periodSeconds: 5
      {{- with .Values.nodeSelector }}
      nodeSelector:
      {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
      {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
    {{- toYaml . | nindent 8 }}
  {{- end }}