{{- if .Values.createController }}
apiVersion: {{ include "sealed-secrets.deployment.apiVersion" . }}
kind: Deployment
metadata:
  name: {{ include "sealed-secrets.fullname" . }}
  namespace: {{ include "sealed-secrets.namespace" . }}
  labels: {{- include "sealed-secrets.labels" . | nindent 4 }}
  {{- if .Values.commonAnnotations }}
  annotations: {{- toYaml .Values.commonAnnotations | nindent 4 }}
  {{- end }}
spec:
  selector:
    matchLabels: {{- include "sealed-secrets.matchLabels" . | nindent 6 }}
  template:
    metadata:
      {{- if .Values.podAnnotations }}
      annotations: {{- toYaml .Values.podAnnotations | nindent 8 }}
      {{- end }}
      labels: {{- include "sealed-secrets.matchLabels" . | nindent 8 }}
        {{- if .Values.podLabels }}
        {{- toYaml .Values.podLabels | nindent 8 }}
        {{- end }}
    spec:
      {{- if .Values.image.pullSecrets }}
      imagePullSecrets:
      {{- range .Values.image.pullSecrets }}
        - name: {{ . }}
      {{- end }}
      {{- end }}
      {{- if .Values.affinity }}
      affinity: {{- toYaml .Values.affinity | nindent 8 }}
      {{- end }}
      {{- if .Values.nodeSelector }}
      nodeSelector: {{- toYaml .Values.nodeSelector | nindent 8 }}
      {{- end }}
      {{- if .Values.tolerations }}
      tolerations: {{- toYaml .Values.tolerations | nindent 8 }}
      {{- end }}
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName | quote }}
      {{- end }}
      {{- if .Values.runtimeClassName }}
      runtimeClassName: {{ .Values.runtimeClassName | quote }}
      {{- end }}
      {{- if .Values.podSecurityContext.enabled }}
      securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "sealed-secrets.serviceAccountName" . }}
      containers:
        - name: controller
          command:
          {{- if .Values.command }}
            {{- include "sealed-secrets.render" (dict "value" .Values.command "context" $) | nindent 12 }}
          {{- else }}
            - controller
          {{- end }}
          args:
          {{- if .Values.args }}
            {{- include "sealed-secrets.render" (dict "value" .Values.args "context" $) | nindent 12 }}
          {{- else }}
            {{- if .Values.updateStatus }}
            - --update-status
            {{- end }}
            {{- if .Values.keyrenewperiod }}
            - --key-renew-period
            - {{ .Values.keyrenewperiod | quote }}
            {{- end }}
            - --key-prefix
            - {{ .Values.secretName | quote }}
          {{- end }}
          image: {{ printf "%s/%s:%s" .Values.image.registry .Values.image.repository .Values.image.tag }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - containerPort: 8080
              name: http
          {{- if .Values.startupProbe.enabled }}
          startupProbe: {{- include "sealed-secrets.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }}
            tcpSocket:
              port: http
          {{- else if .Values.customStartupProbe }}
          startupProbe: {{- include "sealed-secrets.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
          {{- end }}
          {{- if .Values.livenessProbe.enabled }}
          livenessProbe: {{- include "sealed-secrets.render" (dict "value" (omit .Values.livenessProbe "enabled") "context" $) | nindent 12 }}
            httpGet:
              path: /healthz
              port: http
          {{- else if .Values.customLivenessProbe }}
          livenessProbe: {{- include "sealed-secrets.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
          {{- end }}
          {{- if .Values.readinessProbe.enabled }}
          readinessProbe: {{- include "sealed-secrets.render" (dict "value" (omit .Values.readinessProbe "enabled") "context" $) | nindent 12 }}
            httpGet:
              path: /healthz
              port: http
          {{- else if .Values.customReadinessProbe }}
          readinessProbe: {{- include "sealed-secrets.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
          {{- end }}
          {{- if .Values.resources }}
          resources: {{- toYaml .Values.resources | nindent 12 }}
          {{- end }}
          {{- if .Values.containerSecurityContext.enabled }}
          securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
          volumeMounts:
            - mountPath: /tmp
              name: tmp
      volumes:
        - name: tmp
          emptyDir: {}
{{- end }}
