{{- if .Values.redisInsight.enabled }}
apiVersion: v1
kind: Service
metadata:
  name: {{ include "redis-cluster.redisInsightName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "redis-cluster.redisInsightLabels" . | nindent 4 }}
spec:
  type: ClusterIP
  ports:
    - name: http
      port: 80
      targetPort: http
      protocol: TCP
  selector:
    {{- include "redis-cluster.redisInsightSelectorLabels" . | nindent 4 }}
{{- if .Values.redisInsight.persistence.enabled }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ include "redis-cluster.redisInsightName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "redis-cluster.redisInsightLabels" . | nindent 4 }}
  {{- with .Values.redisInsight.persistence.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  accessModes:
    {{- toYaml .Values.redisInsight.persistence.accessModes | nindent 4 }}
  {{- with .Values.redisInsight.persistence.storageClass }}
  storageClassName: {{ . | quote }}
  {{- end }}
  resources:
    requests:
      storage: {{ .Values.redisInsight.persistence.size }}
{{- end }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "redis-cluster.redisInsightName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "redis-cluster.redisInsightLabels" . | nindent 4 }}
spec:
  replicas: 1
  # RedisInsight stores its connection database under /data. Recreate avoids
  # two pods contending for the same ReadWriteOnce volume during an upgrade.
  strategy:
    type: Recreate
  selector:
    matchLabels:
      {{- include "redis-cluster.redisInsightSelectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "redis-cluster.redisInsightSelectorLabels" . | nindent 8 }}
      annotations:
        sidecar.istio.io/inject: "false"
        {{- with .Values.redisInsight.podAnnotations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      {{- if and .Values.externalAccess.enabled (not .Values.redisInsight.connection.host) }}
      serviceAccountName: {{ include "redis-cluster.serviceAccountName" . }}
      automountServiceAccountToken: false
      {{- end }}
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
      {{- if and .Values.externalAccess.enabled (not .Values.redisInsight.connection.host) }}
      initContainers:
        - name: discover-bootstrap-endpoint
          image: "{{ .Values.externalAccess.endpointDiscovery.image.repository }}:{{ .Values.externalAccess.endpointDiscovery.image.tag }}"
          imagePullPolicy: {{ .Values.externalAccess.endpointDiscovery.image.pullPolicy }}
          command: ["/bin/sh", "/scripts/discover-external-endpoint.sh"]
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: EXTERNAL_SERVICE_NAME
              value: {{ include "redis-cluster.bootstrapServiceName" . | quote }}
          resources:
            {{- toYaml .Values.externalAccess.endpointDiscovery.resources | nindent 12 }}
          volumeMounts:
            - name: scripts
              mountPath: /scripts
              readOnly: true
            - name: bootstrap-endpoint
              mountPath: /external-endpoint
            - name: kube-api-access
              mountPath: /var/run/secrets/kubernetes.io/serviceaccount
              readOnly: true
      {{- end }}
      containers:
        - name: redisinsight
          image: "{{ .Values.redisInsight.image.repository }}:{{ .Values.redisInsight.image.tag }}"
          imagePullPolicy: {{ .Values.redisInsight.image.pullPolicy }}
          {{- if and .Values.externalAccess.enabled (not .Values.redisInsight.connection.host) }}
          # Preserve the image CMD as arguments; this wrapper only injects the
          # dynamically discovered LoadBalancer endpoint before exec.
          command: ["/scripts/start-redisinsight.sh"]
          {{- end }}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          env:
            - name: RI_APP_HOST
              value: "0.0.0.0"
            - name: RI_APP_PORT
              value: {{ .Values.redisInsight.port | quote }}
            # These variables register a connection inside RedisInsight only;
            # they do not alter the Redis cluster or its Kubernetes resources.
            - name: RI_REDIS_HOST
              value: {{ default (include "redis-cluster.bootstrapServiceName" .) .Values.redisInsight.connection.host | quote }}
            - name: RI_REDIS_PORT
              value: {{ default (ternary .Values.externalAccess.port .Values.redis.port .Values.externalAccess.enabled) .Values.redisInsight.connection.port | quote }}
            - name: RI_REDIS_ALIAS
              value: {{ .Values.redisInsight.connection.alias | quote }}
            - name: RI_REDIS_TLS
              value: {{ .Values.redisInsight.connection.tls | quote }}
            {{- if .Values.auth.enabled }}
            - name: RI_REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ include "redis-cluster.secretName" . }}
                  key: {{ include "redis-cluster.secretKey" . }}
            {{- end }}
            - name: RI_STDOUT_LOGGER
              value: "true"
          ports:
            - name: http
              containerPort: {{ .Values.redisInsight.port }}
              protocol: TCP
          startupProbe:
            httpGet:
              path: /api/health/
              port: http
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 60
          readinessProbe:
            httpGet:
              path: /api/health/
              port: http
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /api/health/
              port: http
            periodSeconds: 20
            timeoutSeconds: 3
            failureThreshold: 5
          resources:
            {{- toYaml .Values.redisInsight.resources | nindent 12 }}
          volumeMounts:
            - name: data
              mountPath: /data
            {{- if and .Values.externalAccess.enabled (not .Values.redisInsight.connection.host) }}
            - name: scripts
              mountPath: /scripts
              readOnly: true
            - name: bootstrap-endpoint
              mountPath: /bootstrap-endpoint
              readOnly: true
            {{- end }}
      volumes:
        - name: data
          {{- if .Values.redisInsight.persistence.enabled }}
          persistentVolumeClaim:
            claimName: {{ include "redis-cluster.redisInsightName" . }}
          {{- else }}
          emptyDir: {}
          {{- end }}
        {{- if and .Values.externalAccess.enabled (not .Values.redisInsight.connection.host) }}
        - name: scripts
          configMap:
            name: {{ include "redis-cluster.fullname" . }}
            defaultMode: 0555
        - name: bootstrap-endpoint
          emptyDir: {}
        - name: kube-api-access
          projected:
            defaultMode: 0444
            sources:
              - serviceAccountToken:
                  path: token
                  expirationSeconds: 3600
              - configMap:
                  name: kube-root-ca.crt
                  items:
                    - key: ca.crt
                      path: ca.crt
        {{- end }}
      {{- with .Values.redisInsight.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.redisInsight.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
{{- end }}