apiVersion: apps/v1
kind: Deployment
metadata:
  name: hub
  labels:
    {{- include "jupyterhub.labels" . | nindent 4 }}
spec:
  replicas: 1
  selector:
    matchLabels:
      {{- include "jupyterhub.matchLabels" . | nindent 6 }}
  strategy:
    {{- .Values.hub.deploymentStrategy | toYaml | trimSuffix "\n" | nindent 4 }}
  template:
    metadata:
      labels:
        {{- /* Changes here will cause the Deployment to restart the pods. */}}
        {{- include "jupyterhub.matchLabels" . | nindent 8 }}
        hub.jupyter.org/network-access-proxy-api: "true"
        hub.jupyter.org/network-access-proxy-http: "true"
        hub.jupyter.org/network-access-singleuser: "true"
        {{- if .Values.hub.labels }}
        {{- .Values.hub.labels | toYaml | trimSuffix "\n" | nindent 8 }}
        {{- end }}
      annotations:
        # This lets us autorestart when the secret changes!
        checksum/config-map: {{ include (print .Template.BasePath "/hub/configmap.yaml") . | sha256sum }}
        checksum/secret: {{ include (print .Template.BasePath "/hub/secret.yaml") . | sha256sum }}
        {{- if .Values.hub.annotations }}
        {{- .Values.hub.annotations | toYaml | trimSuffix "\n" | nindent 8 }}
        {{- end }}
    spec:
      {{- if .Values.scheduling.podPriority.enabled }}
      priorityClassName: {{ .Release.Name }}-default-priority
      {{- end }}
      nodeSelector: {{ toJson .Values.hub.nodeSelector }}
      {{- include "jupyterhub.coreAffinity" . | nindent 6 }}
      volumes:
        - name: config
          configMap:
            name: hub-config
        - name: secret
          secret:
            secretName: hub-secret
        {{- if .Values.hub.extraVolumes }}
        {{- .Values.hub.extraVolumes | toYaml | trimSuffix "\n" | nindent 8 }}
        {{- end }}
        {{- if eq .Values.hub.db.type "sqlite-pvc" }}
        - name: hub-db-dir
          persistentVolumeClaim:
            claimName: hub-db-dir
        {{- end }}
      {{- if .Values.rbac.enabled }}
      serviceAccountName: hub
      {{- end }}
      securityContext:
        runAsUser: {{ .Values.hub.uid }}
        fsGroup: {{ .Values.hub.fsGid }}
      {{- if .Values.hub.imagePullSecret.enabled }}
      imagePullSecrets:
        - name: hub-image-credentials
      {{- end }}
      containers:
        {{- if .Values.hub.extraContainers }}
        {{- .Values.hub.extraContainers | toYaml | trimSuffix "\n" | nindent 8 }}
        {{- end }}
        - name: hub
          image: {{ .Values.hub.image.name }}:{{ .Values.hub.image.tag }}
          command:
            - jupyterhub
            - --config
            - /srv/jupyterhub_config.py
            {{- if .Values.debug.enabled }}
            - --debug
            {{- end }}
            {{- /*
            We want to do automatic upgrades for sqlite-pvc by default, but
            allow users to opt out of that if they want. Users using their own
            db need to 'opt in' Go Templates treat nil and "" and false as
            'false', making this code complex. We can probably make this a
            one-liner, but doing combinations of boolean vars in go templates is
            very inelegant & hard to reason about.
            */}}
            {{- $upgradeType := typeOf .Values.hub.db.upgrade }}
            {{- if eq $upgradeType "bool" }}
            {{- /* .Values.hub.db.upgrade has been explicitly set to true or false */}}
            {{- if .Values.hub.db.upgrade }}
            - --upgrade-db
            {{- end }}
            {{- else if eq $upgradeType "<nil>" }}
            {{- /* .Values.hub.db.upgrade is nil */}}
            {{- if eq .Values.hub.db.type "sqlite-pvc" }}
            - --upgrade-db
            {{- end }}
            {{- end }}
          volumeMounts:
            - mountPath: /etc/jupyterhub/config/
              name: config
            - mountPath: /etc/jupyterhub/secret/
              name: secret
            {{- if .Values.hub.extraVolumeMounts }}
            {{- .Values.hub.extraVolumeMounts | toYaml | trimSuffix "\n" | nindent 12 }}
            {{- end }}
            {{- if eq .Values.hub.db.type "sqlite-pvc" }}
            - mountPath: /srv/jupyterhub
              name: hub-db-dir
              {{- if .Values.hub.db.pvc.subPath }}
              subPath: {{ .Values.hub.db.pvc.subPath | quote }}
              {{- end }}
            {{- end }}
          resources:
            {{- .Values.hub.resources | toYaml | trimSuffix "\n" | nindent 12 }}
          imagePullPolicy: {{ .Values.hub.imagePullPolicy }}
          env:
            - name: PYTHONUNBUFFERED
              value: "1"
            - name: HELM_RELEASE_NAME
              value: {{ .Release.Name | quote }}
            {{- if .Values.hub.cookieSecret }}
            - name: JPY_COOKIE_SECRET
              valueFrom:
                secretKeyRef:
                  name: hub-secret
                  key: hub.cookie-secret
            {{- end }}
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: CONFIGPROXY_AUTH_TOKEN
              valueFrom:
                secretKeyRef:
                  name: hub-secret
                  key: proxy.token
            {{- if .Values.auth.state.enabled }}
            - name: JUPYTERHUB_CRYPT_KEY
              valueFrom:
                secretKeyRef:
                  name: hub-secret
                  key: auth.state.crypto-key
            {{- end }}
            {{- if .Values.hub.db.password }}
            {{- if eq .Values.hub.db.type "mysql" }}
            - name: MYSQL_PWD
              valueFrom:
                secretKeyRef:
                  name: hub-secret
                  key: hub.db.password
            {{- else if eq .Values.hub.db.type "postgres" }}
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
                  name: hub-secret
                  key: hub.db.password
            {{- end }}
            {{- end }}
            {{- if .Values.hub.extraEnv }}
            {{- $extraEnvType := typeOf .Values.hub.extraEnv }}
            {{- /* If we have a list, embed that here directly. This allows for complex configuration from configmap, downward API, etc. */}}
            {{- if eq $extraEnvType "[]interface {}" }}
            {{- .Values.hub.extraEnv | toYaml | trimSuffix "\n" | nindent 12 }}
            {{- else if eq $extraEnvType "map[string]interface {}" }}
            {{- /* If we have a map, treat those as key-value pairs. */}}
            {{- range $key, $value := .Values.hub.extraEnv }}
            - name: {{ $key | quote }}
              value: {{ $value | quote }}
            {{- end }}
            {{- end }}
            {{- end }}
          ports:
            - containerPort: 8081
              name: hub