_podtemplate.yaml

{{- define "mender.tenantadmPodTemplate" -}}
metadata:
  {{- with .dot.Values.tenantadm.podAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  labels:
    {{- include "mender.labels" . | nindent 4 }}
spec:
  serviceAccountName: {{ include "mender.serviceAccountName" . }}
  {{- with (coalesce .dot.Values.tenantadm.affinity .dot.Values.default.affinity) }}
  affinity: {{ toYaml . | nindent 4 }}
  {{- end }}
  {{- with (coalesce .dot.Values.tenantadm.tolerations .dot.Values.default.tolerations) }}
  tolerations: {{ toYaml . | nindent 4 }}
  {{- end }}
  {{- if .dot.Values.tenantadm.podSecurityContext.enabled }}
  securityContext: {{- omit .dot.Values.tenantadm.podSecurityContext "enabled" | toYaml | nindent 4 }}
  {{- end }}

  {{- with .restartPolicy }}
  restartPolicy: {{ quote . }}
  {{- end }}
  containers:
  - name: {{ ternary "tenantadm" "tenantadm-migration" (empty .migration) | quote }}
    image: {{ include "mender.image" . }}
    imagePullPolicy: {{ include "mender.imagePullPolicy" . }}
    {{- if .dot.Values.tenantadm.containerSecurityContext.enabled }}
    securityContext: {{- omit .dot.Values.tenantadm.containerSecurityContext "enabled" | toYaml | nindent 6 }}
    {{- end }}

    {{- with include "mender.resources" (list .dot.Values.default.resources .dot.Values.tenantadm.resources .extraResources )}}
    resources: {{- nindent 6 . }}
    {{- end }}

    {{- if .args }}
    args: {{- toYaml .args | nindent 6 }}
    {{- else if .dot.Values.tenantadm.args }}
    args: {{- toYaml .dot.Values.tenantadm.args | nindent 6 }}
    {{- end }}


    {{- if (not .migration) }}
    # Readiness/liveness probes
    readinessProbe:
      httpGet:
        path: /api/internal/v1/tenantadm/health
        port: 8080
      periodSeconds: 15
      {{- with include "mender.probesOverrides" (dict "default" .dot.Values.default.probesOverrides "override" .dot.Values.tenantadm.probesOverrides ) }}
      {{- nindent 6 . }}
      {{- end }}
    livenessProbe:
      httpGet:
        path: /api/internal/v1/tenantadm/alive
        port: 8080
      periodSeconds: 5
      {{- with include "mender.probesOverrides" (dict "default" .dot.Values.default.probesOverrides "override" .dot.Values.tenantadm.probesOverrides ) }}
      {{- nindent 6 . }}
      {{- end }}
    startupProbe:
      httpGet:
        path: /api/internal/v1/tenantadm/alive
        port: 8080
      failureThreshold: 36
      periodSeconds: 5
    {{- end }}

    {{- if and (not .migration)
      .dot.Values.tenantadm.certs
      (or .dot.Values.tenantadm.certs.key
          .dot.Values.tenantadm.certs.existingSecret)
      }}
    volumeMounts:
    - name: rsa
      mountPath: "/etc/tenantadm/rsa/"
      readOnly: true
    {{- with .dot.Values.tenantadm.mountSecrets }}
    {{- toYaml .volumeMounts | nindent 4 }}
    {{- end }}
    {{- end }}

    env:
    - name: TENANTADM_MIDDLEWARE
      value: {{ .dot.Values.tenantadm.env.TENANTADM_MIDDLEWARE | quote }}
    - name: TENANTADM_SERVER_PRIV_KEY_PATH
      value: {{ .dot.Values.tenantadm.env.TENANTADM_SERVER_PRIV_KEY_PATH | quote }}
    - name: TENANTADM_DEPLOYMENTS_ADDR
      value: {{ printf "http://%s:%v" .dot.Values.deployments.service.name .dot.Values.deployments.service.port | quote }}
    - name: TENANTADM_DEVICEAUTH_ADDR
      value: {{ printf "http://%s:%v" .dot.Values.device_auth.service.name .dot.Values.device_auth.service.port | quote }}
    - name: TENANTADM_INVENTORY_ADDR
      value: {{ printf "http://%s:%v" .dot.Values.inventory.service.name .dot.Values.inventory.service.port | quote }}
    - name: TENANTADM_ORCHESTRATOR_ADDR
      value: {{ printf "http://%s:%v" .dot.Values.workflows.service.name .dot.Values.workflows.service.port | quote }}
    - name: TENANTADM_USERADM_ADDR
      value: {{ printf "http://%s:%v" .dot.Values.useradm.service.name .dot.Values.useradm.service.port | quote }}
    {{- if and .dot.Values.auditlogs.enabled .dot.Values.global.enterprise }}
    - name: TENANTADM_AUDITLOGS_ADDR
      value: {{ printf "http://%s:%v" .dot.Values.auditlogs.service.name .dot.Values.auditlogs.service.port | quote }}
    {{- end }}
    - name: TENANTADM_RECAPTCHA_URL_VERIFY
      value: {{ .dot.Values.tenantadm.env.TENANTADM_RECAPTCHA_URL_VERIFY | quote }}
    - name: TENANTADM_DEFAULT_API_LIMITS
      value: {{ .dot.Values.tenantadm.env.TENANTADM_DEFAULT_API_LIMITS | quote }}
    {{- if .dot.Values.global.hosted }}
    - name: TENANTADM_ENABLE_SELF_SERVICE_SIGN_UP
      value: {{ .dot.Values.global.hosted | quote }}
    {{- end }}
    {{- include "mender.customEnvs" (merge (deepCopy .dot.Values.tenantadm) (deepCopy (default (dict) .dot.Values.default))) | nindent 4 }}

    # Supported configuration settings: https://github.com/mendersoftware/tenantadm/blob/master/config.yaml
    # Set in order, last value for the key will be used in case duplications.
    envFrom:
    - prefix: TENANTADM_
      secretRef:
        name: {{ .dot.Values.global.mongodb.existingSecret | default (ternary "mongodb-common" "mongodb-common-prerelease" (empty .migration)) }}


  {{- with (coalesce .dot.Values.tenantadm.nodeSelector .dot.Values.default.nodeSelector) }}
  nodeSelector: {{ toYaml . | nindent 4 }}
  {{- end }}

  {{- if and (not .migration)
    .dot.Values.tenantadm.certs
    (or .dot.Values.tenantadm.certs.key
        .dot.Values.tenantadm.certs.existingSecret)
    }}
  volumes:
  - name: rsa
    secret:
      {{- with .dot.Values.tenantadm.certs }}
      {{- if .existingSecret }}
      secretName: {{ .existingSecret }}
      {{- else }}
      secretName: rsa-tenantadm
      {{- end }}
      {{- end }}
  {{- with .dot.Values.tenantadm.mountSecrets }}
  {{- toYaml .volumes | nindent 2 }}
  {{- end }}
  {{- end }}

  {{- if and .dot.Values.global.image .dot.Values.global.image.username }}
  imagePullSecrets:
  - name: {{ ternary "docker-registry" "docker-registry-prerelease" (empty .migration) }}
  {{- else }}
  {{- $ips := coalesce .dot.Values.tenantadm.imagePullSecrets .dot.Values.default.imagePullSecrets  }}
  {{- if $ips }}
  imagePullSecrets:
  {{- toYaml $ips | nindent 4}}
  {{- end }}
  {{- end }}

  {{- $pcn := coalesce .dot.Values.tenantadm.priorityClassName .dot.Values.global.priorityClassName -}}
  {{- if $pcn }}
  priorityClassName: {{ $pcn }}
  {{- end }}

{{- end }}