apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Values.name }}
  labels: {{ include "template.labels" . | nindent 4 }}
  annotations:
    {{- if .Values.env }}
    reloader.stakater.com/search: "true"
    {{- end }}
spec:
  replicas: {{ .Values.replicaCount }}
  revisionHistoryLimit: {{ .Values.revisionHistoryLimit | default 0 }}
  selector:
    matchLabels: {{ include "template.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels: {{ include "template.labels" . | nindent 8 }}
    spec:
    {{- with .Values.imagePullSecrets }}
      imagePullSecrets: {{ toYaml . | nindent 8 }}
    {{- end }}
    {{- if .Values.nodeSelector }}
      nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }}
    {{- end }}
    {{- with .Values.volumes }}
      volumes: {{ toYaml . | nindent 8 }}
    {{- end }}
      automountServiceAccountToken: {{ .Values.automountServiceAccountToken | default false }}
      securityContext:
    {{- if .Values.podSecurityContext }}
    {{- toYaml .Values.podSecurityContext | nindent  8 }}
    {{- else }}
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
    {{- end }}
      containers:
        - name: {{ .Values.name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          {{- with .Values.customCommand }}
          {{- with .command }}
          command: {{ toYaml . | nindent 12}}
          {{- end}}
          {{- with .args }}
          args: {{ toYaml . | nindent 12 }}
          {{- end }}
          {{- end }}
          securityContext:
          {{- if .Values.securityContext }}
          {{- toYaml .Values.securityContext | nindent 12 }}
          {{- else }}
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          {{- end }}
          envFrom:
          {{- if .Values.env }}
            - configMapRef:
                name: {{ .Values.name }}-env
          {{- end }}
          {{- if .Values.vault }}
          {{- if .Values.vault.path }}
            - secretRef:
                name: {{ .Values.name }}-env
          {{- end }}
          {{- end }}
          {{- if .Values.services }}
          ports:
            {{- range $name, $s := .Values.services }}
            - name: {{ $name }}
              containerPort: {{ $s.port }}
              protocol: {{ $s.protocol }}
          {{- end }}
          {{- end }}
          {{- with .Values.livenessProbe }}
          livenessProbe: {{ toYaml . | nindent 12 }}
          {{- end }}
          {{- with .Values.volumeMounts }}
          volumeMounts: {{ toYaml . | nindent 12 }}
          {{- end }}
          {{- with .Values.resources }}
          resources: {{ toYaml . | nindent 12 }}
          {{- end }}