{{- if .Values.kafka.enabled }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mqtrigger-kafka
  labels:
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    svc: mqtrigger
    messagequeue: kafka
spec:
  replicas: 1
  selector:
    matchLabels:
      svc: mqtrigger
      messagequeue: kafka
  template:
    metadata:
      labels:
        svc: mqtrigger
        messagequeue: kafka
    spec:
      containers:
      - name: mqtrigger
      {{- if eq .Values.imageTag "" }}
        image: "{{ .Values.image }}"
      {{- else }}
        image: "{{ .Values.image }}:{{ .Values.imageTag }}"
      {{- end }}
        imagePullPolicy: {{ .Values.pullPolicy }}
        command: ["/fission-bundle"]
        args: ["--mqt", "--routerUrl", "http://router.{{ .Release.Namespace }}"]
        env:
        - name: MESSAGE_QUEUE_TYPE
          value: kafka
        - name: MESSAGE_QUEUE_URL
          value: "{{.Values.kafka.brokers}}"
        - name: MESSAGE_QUEUE_KAFKA_VERSION
          value: "{{.Values.kafka.version}}"
        - name: DEBUG_ENV
          value: {{ .Values.debugEnv | quote }}
        - name: PPROF_ENABLED
          value: {{ .Values.pprof.enabled | quote }}
        {{- include "opentracing.envs" . | indent 8 }}
        {{- include "opentelemtry.envs" . | indent 8 }}
        # TLS authentication is TLS with authentication (2 way)
        # More info: https://docs.confluent.io/current/kafka/authentication_ssl.html#ssl-overview
        {{- if .Values.kafka.authentication.tls.enabled }}
        - name: TLS_ENABLED
          value: "true"
        - name: MESSAGE_QUEUE_SECRETS
          value: /etc/fission/secrets
        - name: INSECURE_SKIP_VERIFY
          value: "{{ .Values.kafka.authentication.tls.insecureSkipVerify }}"
        volumeMounts:
        - name: kafka-secrets
          mountPath: /etc/fission/secrets
        {{- end }}
        {{- if .Values.terminationMessagePath }}
        terminationMessagePath: {{ .Values.terminationMessagePath }}
        {{- end }}
        {{- if .Values.terminationMessagePolicy }}
        terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
        {{- end }}
      serviceAccountName: fission-svc
      {{- if .Values.kafka.authentication.tls.enabled }}
      volumes:
      - name: kafka-secrets
        secret:
          secretName: mqtrigger-kafka-secrets
      {{- end }}

---
{{- if .Values.kafka.authentication.tls.enabled }}
apiVersion: v1
kind: Secret
metadata:
  name: mqtrigger-kafka-secrets
  labels:
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
data:
  {{- if .Files.Get  (printf "%s" .Values.kafka.authentication.tls.caCert) }}
  caCert: {{ .Files.Get (printf "%s" .Values.kafka.authentication.tls.caCert) | b64enc }}
  {{- else }}
  {{ fail "Invalid chart. CA Certificate not found." }}
  {{- end }}
  {{- if .Files.Get (printf "%s" .Values.kafka.authentication.tls.userCert) }}
  userCert: {{ .Files.Get (printf "%s" .Values.kafka.authentication.tls.userCert) | b64enc }}
  {{- else }}
  {{ fail "Invalid chart. User Certificate not found." }}
  {{- end }}
  {{- if .Files.Get (printf "%s" .Values.kafka.authentication.tls.userKey) }}
  userKey: {{ .Files.Get (printf "%s" .Values.kafka.authentication.tls.userKey) | b64enc }}
  {{- else }}
  {{ fail "Invalid chart. User Key not found." }}
  {{- end }}
{{- end }}
{{- if .Values.extraCoreComponentPodConfig }}
{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
{{- end }}
{{- end }}