apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "gemini.fullname" . }}-controller
  labels:
    app: gemini
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gemini
  template:
    metadata:
      labels:
        app: gemini
{{- if .Values.additionalPodLabels }}
{{ toYaml .Values.additionalPodLabels | indent 8 }}
{{- end }}
{{- if .Values.additionalPodAnnotations }}
      annotations:
{{- end }}
{{- with .Values.additionalPodAnnotations }}
{{ toYaml . | indent 8 }}
{{- end }}
    spec:
      {{- if .Values.rbac.create }}
      serviceAccountName: {{ include "gemini.fullname" . }}-controller
      {{- else }}
      serviceAccountName: {{ .Values.rbac.serviceAccountName }}
      {{- end }}
      nodeSelector:
        node-role.kubernetes.io/control-plane: ""
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/control-plane
      containers:
      - command:
        - gemini
        {{- with .Values.verbosity }}
        - -v
        - {{ . | quote }}
        {{- end }}
        image: "{{.Values.image.repository}}:{{ .Values.image.tag | default .Chart.AppVersion }}"
        imagePullPolicy: '{{.Values.image.pullPolicy}}'
        name: gemini-controller
        resources:
          {{- toYaml .Values.resources | nindent 12 }}
        securityContext:
          allowPrivilegeEscalation: false
          privileged: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          capabilities:
            drop:
              - ALL
      {{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
      {{- end }}
      {{- if .Values.tolerations }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 -}}
      {{- end }}
      {{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 -}}
      {{- end }}
