{{- if not (eq .Values.architecture "replicaset") }}
apiVersion: {{ if .Values.useStatefulSet }}{{ include "common.capabilities.statefulset.apiVersion" . }}{{- else }}{{ include "common.capabilities.deployment.apiVersion" . }}{{- end }}
kind: {{ if .Values.useStatefulSet }}StatefulSet{{- else }}Deployment{{- end }}
metadata:
  name: {{ include "mongodb.fullname" . }}
  namespace: {{ include "mongodb.namespace" . }}
  labels: {{- include "common.labels.standard" . | nindent 4 }}
    app.kubernetes.io/component: mongodb
    {{- if .Values.labels }}
    {{- include "common.tplvalues.render" (dict "value" .Values.labels "context" $) | nindent 4 }}
    {{- end }}
  {{- if .Values.annotations }}
  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.annotations "context" $) | nindent 4 }}
  {{- end }}
spec:
  {{- if .Values.useStatefulSet }}
  serviceName: {{ include "mongodb.fullname" . }}
  updateStrategy:
  {{- else }}
  strategy:
  {{- end }}
    type: {{ .Values.strategyType }}
    {{- if or (and (not .Values.useStatefulSet) (eq "Recreate" .Values.strategyType)) (and .Values.useStatefulSet (eq "OnDelete" .Values.strategyType))  }}
    rollingUpdate: null
    {{- end }}
  selector:
    matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
      app.kubernetes.io/component: mongodb
  template:
    metadata:
      labels: {{- include "common.labels.standard" . | nindent 8 }}
        app.kubernetes.io/component: mongodb
        {{- if .Values.podLabels }}
        {{- include "common.tplvalues.render" (dict "value" .Values.podLabels "context" $) | nindent 8 }}
        {{- end }}
      {{- if or (include "mongodb.createConfigmap" .) .Values.podAnnotations }}
      annotations:
        {{- if (include "mongodb.createConfigmap" .) }}
        checksum/configuration: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        {{- end }}
        {{- if .Values.podAnnotations }}
        {{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
        {{- end }}
      {{- end }}
    spec:
      {{- include "mongodb.imagePullSecrets" . | nindent 6 }}
      {{- if .Values.schedulerName }}
      schedulerName: "{{ .Values.schedulerName }}"
      {{- end }}
      serviceAccountName: {{ template "mongodb.serviceAccountName" . }}
      {{- if .Values.affinity }}
      affinity: {{- include "common.tplvalues.render" (dict "value" .Values.affinity "context" $) | nindent 8 }}
      {{- else }}
      affinity:
        podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "component" "mongodb" "context" $) | nindent 10 }}
        podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "component" "mongodb" "context" $) | nindent 10 }}
        nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
      {{- end }}
      {{- if .Values.nodeSelector }}
      nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
      {{- end }}
      {{- if .Values.tolerations }}
      tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }}
      {{- end }}
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
      {{- end }}
      {{- if .Values.podSecurityContext.enabled }}
      securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
      {{- end }}
      {{- if or .Values.initContainers (and .Values.volumePermissions.enabled .Values.persistence.enabled) .Values.tls.enabled }}
      initContainers:
        {{- if .Values.initContainers }}
        {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
        {{- end }}
        {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
        - name: volume-permissions
          image: {{ include "mongodb.volumePermissions.image" . }}
          imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
          command:
            - /bin/bash
            - -ec
          args:
            - |
              mkdir -p {{ .Values.persistence.mountPath }}
              {{- if and .Values.podSecurityContext.enabled .Values.containerSecurityContext.enabled }}
              chown -R "{{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}" "{{ .Values.persistence.mountPath }}"
              {{- end }}
          {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }}
          securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }}
          {{- else }}
          securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }}
          {{- end }}
          {{- if .Values.volumePermissions.resources }}
          resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
          {{- end }}
          volumeMounts:
            - name: datadir
              mountPath: {{ .Values.persistence.mountPath }}
        {{- end }}
        {{- if .Values.tls.enabled }}
        - name: generate-tls-certs
          image: {{ include "mongodb.tls.image" . }}
          imagePullPolicy: {{ .Values.tls.image.pullPolicy | quote }}
          env:
            - name: MY_POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          volumeMounts:
          - name: certs-volume
            mountPath: /certs/CAs
          - name: certs
            mountPath: /certs
          command:
            - sh
            - "-c"
            - |
              /bin/bash <<'EOF'
              my_hostname=$(hostname)
              svc=$(echo -n "$my_hostname" | sed s/-[0-9]*$//)-headless
              cp /certs/CAs/* /certs/
              cat >/certs/openssl.cnf <<EOL
              [req]
              req_extensions = v3_req
              distinguished_name = req_distinguished_name
              [req_distinguished_name]
              [ v3_req ]
              basicConstraints = CA:FALSE
              keyUsage = nonRepudiation, digitalSignature, keyEncipherment
              subjectAltName = @alt_names
              [alt_names]
              DNS.1 = $svc
              DNS.2 = $my_hostname
              DNS.3 = $my_hostname.$svc.$MY_POD_NAMESPACE.svc.cluster.local
              DNS.4 = localhost
              DNS.5 = 127.0.0.1
              EOL

              export RANDFILE=/certs/.rnd && openssl genrsa -out /certs/mongo.key 2048
              #Create the client/server cert
              openssl req -new -key /certs/mongo.key -out /certs/mongo.csr -subj "/C=US/O=My Organisations/OU=IT/CN=$my_hostname" -config /certs/openssl.cnf
              #Signing the server cert with the CA cert and key
              openssl x509 -req -in /certs/mongo.csr -CA /certs/mongodb-ca-cert -CAkey /certs/mongodb-ca-key -CAcreateserial -out /certs/mongo.crt -days 3650 -extensions v3_req -extfile /certs/openssl.cnf
              rm /certs/mongo.csr
              #Concatenate to a pem file for use as the client PEM file which can be used for both member and client authentication.
              cat /certs/mongo.crt /certs/mongo.key > /certs/mongodb.pem
              cd /certs/
              shopt -s extglob
              rm -rf !(mongodb-ca-cert|mongodb.pem|CAs|openssl.cnf)
              EOF
        {{- end }}
      {{- end }}
      containers:
        - name: mongodb
          image: {{ include "mongodb.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
          {{- if .Values.containerSecurityContext.enabled }}
          securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
          {{- if .Values.command }}
          command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
          {{- end }}
          {{- if .Values.args }}
          args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
          {{- end }}
          env:
            - name: BITNAMI_DEBUG
              value: {{ ternary "true" "false" .Values.image.debug | quote }}
            {{- if .Values.auth.username }}
            - name: MONGODB_USERNAME
              value: {{ .Values.auth.username | quote }}
            {{- end }}
            {{- if .Values.auth.database }}
            - name: MONGODB_DATABASE
              value: {{ .Values.auth.database | quote }}
            {{- end }}
            {{- if .Values.auth.enabled }}
            {{- if and .Values.auth.username .Values.auth.database }}
            - name: MONGODB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ include "mongodb.secretName" . }}
                  key: mongodb-password
            {{- end }}
            - name: MONGODB_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ include "mongodb.secretName" . }}
                  key: mongodb-root-password
            {{- end }}
            - name: ALLOW_EMPTY_PASSWORD
              value: {{ ternary "no" "yes" .Values.auth.enabled | quote }}
            - name: MONGODB_SYSTEM_LOG_VERBOSITY
              value: {{ .Values.systemLogVerbosity | quote }}
            - name: MONGODB_DISABLE_SYSTEM_LOG
              value: {{ ternary "yes" "no" .Values.disableSystemLog | quote }}
            - name: MONGODB_ENABLE_IPV6
              value: {{ ternary "yes" "no" .Values.enableIPv6 | quote }}
            - name: MONGODB_ENABLE_DIRECTORY_PER_DB
              value: {{ ternary "yes" "no" .Values.directoryPerDB | quote }}
            {{- if .Values.tls.enabled }}
            - name: MONGODB_EXTRA_FLAGS
              value: --tlsMode=requireTLS --tlsCertificateKeyFile=/certs/mongodb.pem --tlsCAFile=/certs/mongodb-ca-cert
            {{- end }}
            {{- if .Values.extraFlags }}
            - name: MONGODB_EXTRA_FLAGS
              value: {{ .Values.extraFlags | join " " | quote }}
            {{- end }}
            {{- if .Values.tls.enabled }}
            - name: MONGODB_CLIENT_EXTRA_FLAGS
              value: --tls --tlsCertificateKeyFile=/certs/mongodb.pem --tlsCAFile=/certs/mongodb-ca-cert
            {{- end }}
            {{- if .Values.extraEnvVars }}
            {{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
            {{- end }}
          {{- if or .Values.extraEnvVarsCM .Values.extraEnvVarsSecret }}
          envFrom:
            {{- if .Values.extraEnvVarsCM }}
            - configMapRef:
                name: {{ tpl .Values.extraEnvVarsCM . | quote }}
            {{- end }}
            {{- if .Values.extraEnvVarsSecret }}
            - secretRef:
                name: {{ tpl .Values.extraEnvVarsSecret . | quote }}
            {{- end }}
          {{- end }}
          ports:
            - name: mongodb
              containerPort: 27017
          {{- if .Values.livenessProbe.enabled }}
          livenessProbe:
            exec:
              command:
                - mongo
              {{- if .Values.tls.enabled }}
                - --tls
                - --tlsCertificateKeyFile=/certs/mongodb.pem
                - --tlsCAFile=/certs/mongodb-ca-cert
              {{- end }}
                - --eval
                - "db.adminCommand('ping')"
            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
            successThreshold: {{ .Values.livenessProbe.successThreshold }}
            failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
          {{- else if .Values.customLivenessProbe }}
          livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
          {{- end }}
          {{- if .Values.readinessProbe.enabled }}
          readinessProbe:
            exec:
              command:
                - mongo
              {{- if .Values.tls.enabled }}
                - --tls
                - --tlsCertificateKeyFile=/certs/mongodb.pem
                - --tlsCAFile=/certs/mongodb-ca-cert
              {{- end }}
                - --eval
                - "db.adminCommand('ping')"
            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
            successThreshold: {{ .Values.readinessProbe.successThreshold }}
            failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
          {{- else if .Values.customReadinessProbe }}
          readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
          {{- end }}
          {{- if .Values.resources }}
          resources: {{- toYaml .Values.resources | nindent 12 }}
          {{- end }}
          volumeMounts:
            - name: datadir
              mountPath: {{ .Values.persistence.mountPath }}
              subPath: {{ .Values.persistence.subPath }}
            {{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
            - name: custom-init-scripts
              mountPath: /docker-entrypoint-initdb.d
            {{- end }}
            {{- if or .Values.configuration .Values.existingConfigmap }}
            - name: config
              mountPath: /opt/bitnami/mongodb/conf/mongodb.conf
              subPath: mongodb.conf
            {{- end }}
            {{- if .Values.tls.enabled }}
            - name: certs
              mountPath: /certs
            {{- end }}
            {{- if .Values.extraVolumeMounts }}
            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
            {{- end }}
        {{- if .Values.metrics.enabled }}
        - name: metrics
          image: {{ template "mongodb.metrics.image" . }}
          imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
          {{- if .Values.containerSecurityContext.enabled }}
          securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
          command:
            - /bin/bash
            - -ec
          args:
            - |
              /bin/mongodb_exporter --mongodb.uri "{{ include "mongodb.mongodb_exporter.uri" . }}" {{ .Values.metrics.extraFlags }}
          env:
          {{- if .Values.auth.enabled }}
          - name: MONGODB_ROOT_PASSWORD
            valueFrom:
              secretKeyRef:
                name: {{ include "mongodb.secretName" . }}
                key: mongodb-root-password
          {{- end }}
          volumeMounts:
          {{- if .Values.tls.enabled }}
          - name: certs
            mountPath: /certs
          {{- end }}
          ports:
            - name: metrics
              containerPort: 9216
          {{- if .Values.metrics.livenessProbe.enabled }}
          livenessProbe:
            httpGet:
              path: /
              port: metrics
            initialDelaySeconds: {{ .Values.metrics.livenessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.metrics.livenessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.metrics.livenessProbe.timeoutSeconds }}
            failureThreshold: {{ .Values.metrics.livenessProbe.failureThreshold }}
            successThreshold: {{ .Values.metrics.livenessProbe.successThreshold }}
          {{- end }}
          {{- if .Values.metrics.readinessProbe.enabled }}
          readinessProbe:
            httpGet:
              path: /
              port: metrics
            initialDelaySeconds: {{ .Values.metrics.readinessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.metrics.readinessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.metrics.readinessProbe.timeoutSeconds }}
            failureThreshold: {{ .Values.metrics.readinessProbe.failureThreshold }}
            successThreshold: {{ .Values.metrics.readinessProbe.successThreshold }}
          {{- end }}
          {{- if .Values.metrics.resources }}
          resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
          {{- end }}
        {{- end }}
        {{- if .Values.sidecars }}
        {{- include "common.tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }}
        {{- end }}
      volumes:
        {{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
        - name: custom-init-scripts
          configMap:
            name: {{ template "mongodb.initdbScriptsCM" . }}
        {{- end }}
        {{- if or .Values.configuration .Values.existingConfigmap }}
        - name: config
          configMap:
            name: {{ include "mongodb.configmapName" . }}
        {{- end }}
        {{- if .Values.extraVolumes }}
        {{- toYaml .Values.extraVolumes | nindent 8 }}
        {{- end }}
        {{- if .Values.tls.enabled }}
        - name: certs
          emptyDir: {}
        - name: certs-volume
          secret:
            secretName: {{ template "mongodb.caSecretName" . }}
            items:
            - key: mongodb-ca-cert
              path: mongodb-ca-cert
              mode: 511
            - key: mongodb-ca-key
              path: mongodb-ca-key
              mode: 511
        {{- end }}
  {{- if not .Values.persistence.enabled }}
        - name: datadir
          emptyDir: {}
  {{- else if .Values.persistence.existingClaim }}
        - name: datadir
          persistentVolumeClaim:
            claimName: {{ printf "%s" (tpl .Values.persistence.existingClaim .) }}
  {{- else if not .Values.useStatefulSet }}
        - name: datadir
          persistentVolumeClaim:
            claimName: {{ template "mongodb.fullname" . }}
  {{- else }}
  volumeClaimTemplates:
    - metadata:
        name: datadir
        {{- if .Values.persistence.annotations }}
        annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }}
        {{- end }}
      spec:
        accessModes:
        {{- range .Values.persistence.accessModes }}
          - {{ . | quote }}
        {{- end }}
        resources:
          requests:
            storage: {{ .Values.persistence.size | quote }}
        {{- if .Values.persistence.volumeClaimTemplates.selector }}
        selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.volumeClaimTemplates.selector "context" $) | nindent 10 }}
        {{- end }}
        {{ include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) }}
  {{- end }}
{{- end }}