{{- $nodeSelector := dig .Values.env .Values.keycloak.nodeSelector._default .Values.keycloak.nodeSelector }}
{{- $tolerations := dig .Values.env .Values.keycloak.tolerations._default .Values.keycloak.tolerations }}
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ .Chart.Name }}
  labels:
    app: {{ .Chart.Name }}
spec:
  replicas: {{ dig .Values.env .Values.keycloak.replicaCount._default .Values.keycloak.replicaCount }}
  serviceName: {{ .Chart.Name }}
  selector:
    matchLabels:
      app: {{ .Chart.Name }}
  template:
    metadata:
      labels:
        app: {{ .Chart.Name }}
      annotations:
        checksum/secret-env: {{ include (print $.Template.BasePath "/04-secret-envs.yaml") . | sha256sum }}
        checksum/config-env: {{ include (print $.Template.BasePath "/05-cm-envs.yaml") . | sha256sum }}
    spec:
      {{- if $nodeSelector }}
      nodeSelector: {{ toYaml $nodeSelector | nindent 8 }}
      {{- end }}
      {{- if $tolerations }}
      tolerations: {{ toYaml $tolerations | nindent 6 }}
      {{- end }}
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - {{ .Chart.Name }}
              topologyKey: kubernetes.io/hostname
            weight: 100
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      containers:
      - name: keycloak
        image: {{ .Values.image.keycloak }}
        command: [ "/bin/bash","-c","/opt/keycloak/bin/kc.sh start -Djgroups.dns.query={{ .Chart.Name }}-headless.{{ .Release.Namespace }}.svc.cluster.local --legacy-observability-interface=true"]
        envFrom:
          - secretRef:
              name: {{ .Chart.Name }}-env
          - configMapRef:
              name: {{ .Chart.Name }}-env
        ports:
        - name: http
          containerPort: 8080
        - name: health
          containerPort: 9000
        startupProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 60
          failureThreshold: 15
          periodSeconds: 3
          timeoutSeconds: 3
        resources: {{ dig .Values.env .Values.keycloak.resources._default .Values.keycloak.resources | toYaml | nindent 10 }}
        securityContext:
          allowPrivilegeEscalation: false
          runAsUser: 0
---
apiVersion: v1
kind: Service
metadata:
  name: {{ .Chart.Name }}
  labels:
    app: {{ .Chart.Name }}
spec:
  ports:
  - name: http
    port: 8080
    targetPort: 8080
  - name: health
    port: 9000
    targetPort: 9000
  selector:
    app: {{ .Chart.Name }}
---
apiVersion: v1
kind: Service
metadata:
  name: {{ .Chart.Name }}-headless
spec:
  type: ClusterIP
  clusterIP: None
  ports:
  - name: http
    port: 8080
    protocol: TCP
    targetPort: 8080
  - name: health
    port: 9000
    targetPort: 9000
  publishNotReadyAddresses: true
  selector:
    app: {{ .Chart.Name }}