apiVersion: v1
kind: Secret
metadata:
  name: dapr-trust-bundle
  namespace: {{ .Release.Namespace }}
  labels:
    app: dapr-sentry
    {{- range $key, $value := .Values.global.k8sLabels }}
    {{ $key }}: {{ tpl $value $ }}
    {{- end }}
{{ if and .Values.tls.issuer.certPEM (and .Values.tls.issuer.keyPEM .Values.tls.root.certPEM) }}
data:
  issuer.crt: {{ b64enc .Values.tls.issuer.certPEM | trim }}
  issuer.key: {{ b64enc .Values.tls.issuer.keyPEM | trim }}
  ca.crt: {{ b64enc .Values.tls.root.certPEM | trim }}
{{ end }}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: dapr-trust-bundle
  namespace: {{ .Release.Namespace }}
  labels:
    app: dapr-sentry
    {{- range $key, $value := .Values.global.k8sLabels }}
    {{ $key }}: {{ tpl $value $ }}
    {{- end }}
{{ if .Values.tls.root.certPEM }}
data:
  ca.crt: {{- .Values.tls.root.certPEM | toYaml | indent 1}}
{{end}}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dapr-sentry
  namespace: {{ .Release.Namespace }}
  labels:
    app: dapr-sentry
    {{- range $key, $value := .Values.global.k8sLabels }}
    {{ $key }}: {{ tpl $value $ }}
    {{- end }}
spec:
{{- if eq .Values.global.ha.enabled true }}
  replicas: {{ .Values.global.ha.replicaCount }}
{{- else }}
  replicas: {{ .Values.replicaCount }}
{{- end }}
  selector:
    matchLabels:
      app: dapr-sentry
  template:
    metadata:
      labels:
        app: dapr-sentry
        {{- range $key, $value := .Values.global.k8sLabels }}
        {{ $key }}: {{ tpl $value $ }}
        {{- end }}
        {{- with .Values.global.labels }}
          {{- toYaml . | nindent 8 }}
        {{- end }}
      annotations:
        dapr.io/control-plane: sentry
{{- if eq .Values.global.prometheus.enabled true }}
        prometheus.io/scrape: "{{ .Values.global.prometheus.enabled }}"
        prometheus.io/port: "{{ .Values.global.prometheus.port }}"
        prometheus.io/path: "/"
{{- end }}
{{- with .Values.deploymentAnnotations }}
{{ toYaml . | indent 8 }}
{{- end }}
    spec:
      containers:
      - name: dapr-sentry
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          {{- if eq .Values.debug.enabled false }}
          initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
          {{- else }}
          initialDelaySeconds: {{ .Values.debug.initialDelaySeconds }}
          {{- end }}
          periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
          failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8080
          {{- if eq .Values.debug.enabled false }}
          initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
          {{- else }}
          initialDelaySeconds: {{ .Values.debug.initialDelaySeconds }}
          {{- end }}
          periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
          failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
{{- if contains "/" .Values.image.name }}
        image: "{{ .Values.image.name }}"
{{- else }}
        image: "{{ .Values.global.registry }}/{{ .Values.image.name }}:{{ .Values.global.tag }}"
{{- end }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
{{- if eq .Values.global.daprControlPlaneOs "linux" }}
        securityContext:
          runAsNonRoot: {{ .Values.runAsNonRoot }}
  {{- if eq .Values.debug.enabled true }}
          capabilities:
            add: ["SYS_PTRACE"]
  {{- else }}
          readOnlyRootFilesystem: true
          capabilities:
            drop: ["ALL"]
  {{- end }}
  {{- if .Values.global.seccompProfile }}
          seccompProfile:
            type: {{ .Values.global.seccompProfile }}
  {{- end }}
{{- end }}
        env:
        - name: NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        {{- range $name, $value := .Values.extraEnvVars }}
        - name: "{{ $name }}"
          value: "{{ $value }}"
        {{- end }}
        ports:
        - containerPort: 50001
{{- if eq .Values.global.prometheus.enabled true }}
        - name: metrics
          containerPort: {{ .Values.global.prometheus.port }}
          protocol: TCP
{{- end }}
{{- if eq .Values.debug.enabled true }}
        - name: debug
          containerPort: {{ .Values.debug.port }}
          protocol: TCP
{{- end }}
        resources:
{{ toYaml .Values.resources | indent 10 }}
        volumeMounts:
          - name: credentials
            mountPath: /var/run/secrets/dapr.io/credentials
            readOnly: true
        {{- with .Values.global.extraVolumeMounts.sentry }}
          {{- toYaml . | nindent 10 }}
        {{- end }}
        command:
{{- if eq .Values.debug.enabled false }}
        - "/sentry"
{{- else }}
        - "/dlv"
{{- end }}
        args:
{{- if eq .Values.debug.enabled true }}
        - "--listen=:{{ .Values.debug.port }}"
        - "--accept-multiclient"
        - "--headless=true"
        - "--log"
        - "--api-version=2"
        - "exec"
        - "/sentry"
        - "--"
{{- end }}
        - "--log-level"
        - {{ .Values.logLevel }}
{{- if eq .Values.global.logAsJson true }}
        - "--log-as-json"
{{- end }}
{{- if eq .Values.global.prometheus.enabled true }}
        - "--enable-metrics"
        - "--metrics-port"
        - "{{ .Values.global.prometheus.port }}"
{{- else }}
        - "--enable-metrics=false"
{{- end }}
        - "--trust-domain"
        - {{ .Values.global.mtls.controlPlaneTrustDomain }}
{{- with .Values.global.issuerFilenames }}
        - "--issuer-ca-filename"
        - "{{ .ca }}"
        - "--issuer-certificate-filename"
        - "{{ .cert }}"
        - "--issuer-key-filename"
        - "{{ .key }}"
{{- end }}
      serviceAccountName: dapr-sentry
      volumes:
        - name: credentials
          secret:
            secretName: dapr-trust-bundle
      {{- with .Values.global.extraVolumes.sentry }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
                - matchExpressions:
                  - key: kubernetes.io/os
                    operator: In
                    values:
                    - {{ .Values.global.daprControlPlaneOs }}
{{- if .Values.global.daprControlPlaneArch }}
                  - key: kubernetes.io/arch
                    operator: In
                    values:
                    - {{ .Values.global.daprControlPlaneArch }}
{{- end }}
{{- if .Values.global.ha.enabled }}
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - dapr-sentry
              topologyKey: topology.kubernetes.io/zone
{{- end }}
{{- if .Values.global.imagePullSecrets }}
      imagePullSecrets:
        {{- include "dapr.imagePullSecrets" (dict "imagePullSecrets" .Values.global.imagePullSecrets) | nindent 8 -}}
{{- end }}
{{- if .Values.global.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.global.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.global.tolerations }}
      tolerations:
{{ toYaml .Values.global.tolerations | indent 8 }}
{{- end }}
{{- if .Values.global.priorityClassName }}
      priorityClassName:
{{ toYaml .Values.global.priorityClassName | indent 8 }}
{{- end }}
