{{- define "policy_container" }}
    spec:
      serviceAccountName: istio-mixer-service-account
{{- if $.Values.global.priorityClassName }}
      priorityClassName: "{{ $.Values.global.priorityClassName }}"
{{- end }}
      volumes:
      - name: istio-certs
        secret:
          secretName: istio.istio-mixer-service-account
          optional: true
      - name: uds-socket
        emptyDir: {}
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      containers:
      - name: mixer
{{- if contains "/" .Values.image }}
        image: "{{ .Values.image }}"
{{- else }}
        image: "{{ $.Values.global.hub }}/{{ $.Values.image }}:{{ $.Values.global.tag }}"
{{- end }}
        imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
        ports:
        - containerPort: 9093
        - containerPort: 42422
        args:
          - --address
          - unix:///sock/mixer.socket
          - --configStoreURL=k8s://
          - --configDefaultNamespace={{ $.Release.Namespace }}
          - --trace_zipkin_url=http://zipkin:9411/api/v1/spans
        resources:
{{- if .Values.resources }}
{{ toYaml .Values.resources | indent 10 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 10 }}
{{- end }}
        volumeMounts:
        - name: uds-socket
          mountPath: /sock
        livenessProbe:
          httpGet:
            path: /version
            port: 9093
          initialDelaySeconds: 5
          periodSeconds: 5
      - name: istio-proxy
        image: "{{ $.Values.global.hub }}/proxyv2:{{ $.Values.global.tag }}"
        imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
        ports:
        - containerPort: 9091
        - containerPort: 15004
        args:
        - proxy
        - --serviceCluster
        - istio-policy
        - --templateFile
        - /etc/istio/proxy/envoy_policy.yaml.tmpl
      {{- if $.Values.global.controlPlaneSecurityEnabled }}
        - --controlPlaneAuthPolicy
        - MUTUAL_TLS
      {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
      {{- end }}
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        resources:
{{- if $.Values.global.proxy.resources }}
{{ toYaml $.Values.global.proxy.resources | indent 10 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 10 }}
{{- end }}
        volumeMounts:
        - name: istio-certs
          mountPath: /etc/certs
          readOnly: true
        - name: uds-socket
          mountPath: /sock
{{- end }}

{{- define "telemetry_container" }}
    spec:
      serviceAccountName: istio-mixer-service-account
      volumes:
      - name: istio-certs
        secret:
          secretName: istio.istio-mixer-service-account
          optional: true
      - name: uds-socket
        emptyDir: {}
    {{- if $.Values.nodeSelector }}
      nodeSelector:
{{ toYaml $.Values.nodeSelector | indent 8 }}
    {{- end }}
      containers:
      - name: mixer
{{- if contains "/" .Values.image }}
        image: "{{ .Values.image }}"
{{- else }}
        image: "{{ $.Values.global.hub }}/{{ $.Values.image }}:{{ $.Values.global.tag }}"
{{- end }}
        imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
        ports:
        - containerPort: 9093
        - containerPort: 42422
        args:
          - --address
          - unix:///sock/mixer.socket
          - --configStoreURL=k8s://
          - --configDefaultNamespace={{ $.Release.Namespace }}
          - --trace_zipkin_url=http://zipkin:9411/api/v1/spans
        resources:
{{- if .Values.resources }}
{{ toYaml .Values.resources | indent 10 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 10 }}
{{- end }}
        volumeMounts:
        - name: uds-socket
          mountPath: /sock
        livenessProbe:
          httpGet:
            path: /version
            port: 9093
          initialDelaySeconds: 5
          periodSeconds: 5
      - name: istio-proxy
        image: "{{ $.Values.global.hub }}/proxyv2:{{ $.Values.global.tag }}"
        imagePullPolicy: {{ $.Values.global.imagePullPolicy }}
        ports:
        - containerPort: 9091
        - containerPort: 15004
        args:
        - proxy
        - --serviceCluster
        - istio-telemetry
        - --templateFile
        - /etc/istio/proxy/envoy_telemetry.yaml.tmpl
      {{- if $.Values.global.controlPlaneSecurityEnabled }}
        - --controlPlaneAuthPolicy
        - MUTUAL_TLS
      {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
      {{- end }}
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        resources:
{{- if $.Values.global.proxy.resources }}
{{ toYaml $.Values.global.proxy.resources | indent 10 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 10 }}
{{- end }}
        volumeMounts:
        - name: istio-certs
          mountPath: /etc/certs
          readOnly: true
        - name: uds-socket
          mountPath: /sock
{{- end }}


{{- $mixers := list "policy" "telemetry" }}
{{- range $idx, $mname := $mixers }}
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: istio-{{ $mname }}
  namespace: {{ $.Release.Namespace }}
  labels:
    chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }}
    release: {{ $.Release.Name }}
    istio: mixer
spec:
  replicas: {{ $.Values.replicaCount }}
  template:
    metadata:
      labels:
        app: {{ $mname }}
        istio: mixer
        istio-mixer-type: {{ $mname }}
      annotations:
        sidecar.istio.io/inject: "false"
        scheduler.alpha.kubernetes.io/critical-pod: ""
{{- if eq $mname "policy"}}
{{- template "policy_container" $ }}
{{- else }}
{{- template "telemetry_container" $ }}
{{- end }}

---
{{- end }} {{/* range */}}
