{{- if .Values.controller.enabled -}}
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: neuvector-controller-pod
  namespace: {{ .Release.Namespace }}
  labels:
    chart: {{ template "neuvector.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  replicas: {{ .Values.controller.replicas }}
  minReadySeconds: 60
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: neuvector-controller-pod
        release: {{ .Release.Name }}
    spec:
    {{- if .Values.imagePullSecrets }}
      imagePullSecrets:
        - name: {{ .Values.imagePullSecrets }}
    {{- end }}
      containers:
        - name: neuvector-controller-pod
          image: "{{ .Values.registry }}/{{ .Values.controller.image.repository }}:{{ .Values.tag }}"
          securityContext:
            privileged: true
          readinessProbe:
            exec:
              command:
                - cat
                - /tmp/ready
            initialDelaySeconds: 5
            periodSeconds: 5
          env:
            - name: CLUSTER_JOIN_ADDR
              value: neuvector-svc-controller.{{ .Release.Namespace }}
            - name: CLUSTER_ADVERTISED_ADDR
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: CLUSTER_BIND_ADDR
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
          {{- if or .Values.controller.pvc.enabled .Values.controller.azureFileShare.enabled }}
            - name: CTRL_PERSIST_CONFIG
              value: "1"
          {{- end }}
          volumeMounts:
            - mountPath: /var/neuvector
              name: nv-share
              readOnly: false
          {{- if .Values.containerd.enabled }}
            - mountPath: /var/run/containerd/containerd.sock
          {{- else }}
            - mountPath: /var/run/docker.sock
          {{- end }}
              name: runtime-sock
              readOnly: false
            - mountPath: /host/proc
              name: proc-vol
              readOnly: true
            - mountPath: /host/cgroup
              name: cgroup-vol
              readOnly: true            
          lifecycle:
            preStop:
              exec:
                command: ["/usr/local/bin/consul", "leave"]
      terminationGracePeriodSeconds: 60
      restartPolicy: Always
      volumes:
        - name: nv-share
        {{- if .Values.controller.pvc.enabled }}
          persistentVolumeClaim:
            claimName: neuvector-data
        {{- else if .Values.controller.azureFileShare.enabled }}
          azureFile:
            secretName: {{ .Values.controller.azureFileShare.secretName }}
            shareName: {{ .Values.controller.azureFileShare.shareName }}
            readOnly: false
        {{- else }}
          hostPath:
            path: /var/neuvector
        {{- end }}
        - name: runtime-sock
          hostPath:
          {{- if .Values.containerd.enabled }}
            path: {{ .Values.containerd.path }}
          {{- else }}
            path: /var/run/docker.sock
          {{- end }}
        - name: proc-vol
          hostPath:
            path: /proc
        - name: cgroup-vol
          hostPath:
            path: /sys/fs/cgroup
{{- end }}