{{- if .Values.dynamic_proxy.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: dynamic-proxy
  namespace: {{ .Release.Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: {{ .Release.Namespace }}
  name: dynamic-proxy
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "create", "update", "patch"]
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "create", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: dynamic-proxy
  namespace: {{ .Release.Namespace }}
subjects:
- kind: ServiceAccount
  name: dynamic-proxy
  namespace: {{ .Release.Namespace }}
roleRef:
  kind: Role
  name: dynamic-proxy
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dynamic-proxy
  annotations:
    configmap.reloader.stakater.com/reload: "proxy-template"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: dynamic-proxy
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  minReadySeconds: 10
  progressDeadlineSeconds: 15

  template:
    metadata:
      name: dynamic-proxy
      labels:
        app: dynamic-proxy
      annotations:
        dependency.configmap: dynamic-proxy-config-.*
    spec:
      serviceAccountName: dynamic-proxy
      terminationGracePeriodSeconds: 1
      initContainers:
        - name: create-config
          image: goalprofit/dynamic-proxy:1.0.0
          imagePullPolicy: Always
      containers:
      - name: dynamic-proxy
        image: {{ .Values.dynamic_proxy.image }}:{{ .Values.dynamic_proxy.version }}
        imagePullPolicy: Always
        ports:
          - containerPort: 80
        command: ["/bin/sh", "-c"]
        args:
          - |
            export NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
            cat /tmp/nginx/nginx.conf|sed "s/\\\$(NAMESPACE)/$NAMESPACE/g" > /etc/nginx/nginx.conf
            nginx -g 'daemon off;'

        volumeMounts:
          - mountPath: /tmp/nginx/
            readOnly: true
            name: nginx-conf
      volumes:
      - name: nginx-conf
        configMap:
          name: dynamic-proxy-conf

      imagePullSecrets:
      - name: regcred
      {{ include "app.affinity" . | nindent 6}}

---
apiVersion: v1
kind: Service
metadata:
  name: dynamic-proxy
  {{- if $.Values.azure }}
  annotations:
      service.beta.kubernetes.io/azure-load-balancer-internal: "true"
  {{ end }}
spec:
  {{- if $.Values.azure }}
  type: LoadBalancer
  {{- else }}
  type: NodePort
  {{- end }}
  selector:
    app: dynamic-proxy
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 80
      nodePort: {{.Values.dynamic_proxy.port}}
{{ end }}

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: dynamic-proxy-template
data:
  data: |
    events {
      worker_connections 1024;
    }
    http {
      client_max_body_size 200M;
      server_names_hash_bucket_size 256;
      resolver kube-dns.kube-system.svc.cluster.local valid=30s;

      {{ `{{ (http | default('')) | indent(2) }}` }}

      server {
        listen 80;
        server_name {{.Values.domain}};

        error_page 403 @default_403;
        location @default_403 {
          internal;
          return 302 /pages/http-status/403;
        }
      
        {{ `{{ (main_location | default('')) | indent(4) }}` }}

        {{- if .Values.authenticator.enabled -}}
          {{.Values.authenticator.proxy_locations | nindent 8 }}
        {{- end -}}
        {{- if .Values.server.enabled -}}
          {{.Values.server.proxy_locations | nindent 8 }}
        {{- end -}}

      }
    }
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: dynamic-proxy-conf
data:
  nginx.conf: ""
