apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ taskserv.deployment }}
  namespace: {{ taskserv.namespace }}
  labels:
    app.kubernetes.io/name: {{ taskserv.deployment }}
    app.kubernetes.io/managed-by: provisioning
spec:
  replicas: {{ taskserv.replicas }}
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ taskserv.deployment }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ taskserv.deployment }}
    spec:
      containers:
      - name: buildkitd
        image: {{ taskserv.image }}
        args:
        - --config
        - /etc/buildkit/buildkitd.toml
        - --addr
        - unix:///run/buildkit/buildkitd.sock
{% if taskserv.mtls.enabled %}
        - --addr
        - tcp://0.0.0.0:{{ taskserv.port }}
        - --tlscacert
        - {{ taskserv.mtls.cert_mount_path }}/ca.crt
        - --tlscert
        - {{ taskserv.mtls.cert_mount_path }}/tls.crt
        - --tlskey
        - {{ taskserv.mtls.cert_mount_path }}/tls.key
{% else %}
        - --addr
        - tcp://0.0.0.0:{{ taskserv.port }}
{% endif %}
        env:
        - name: DOCKER_CONFIG
          value: /root/.docker
        ports:
        - containerPort: {{ taskserv.port }}
          protocol: TCP
        resources:
          requests:
            cpu: "{{ taskserv.resources.requests.cpu }}"
            memory: "{{ taskserv.resources.requests.memory }}"
          limits:
            cpu: "{{ taskserv.resources.limits.cpu }}"
            memory: "{{ taskserv.resources.limits.memory }}"
        securityContext:
          privileged: {{ taskserv.privileged }}
          seccompProfile:
            type: Unconfined
        volumeMounts:
        - name: docker-config
          mountPath: /root/.docker/config.json
          subPath: config.json
          readOnly: true
        - name: buildkit-socket
          mountPath: /run/buildkit
        - name: buildkitd-config
          mountPath: /etc/buildkit/buildkitd.toml
          subPath: buildkitd.toml
          readOnly: true
{% if taskserv.cache.enabled %}
        - name: buildkit-cache
          mountPath: {{ taskserv.cache.mount_path }}
{% endif %}
{% if taskserv.mtls.enabled %}
        - name: buildkit-mtls-ca
          mountPath: {{ taskserv.mtls.cert_mount_path }}/ca.crt
          subPath: ca.crt
          readOnly: true
        - name: buildkit-mtls-server
          mountPath: {{ taskserv.mtls.cert_mount_path }}/tls.crt
          subPath: tls.crt
          readOnly: true
        - name: buildkit-mtls-server
          mountPath: {{ taskserv.mtls.cert_mount_path }}/tls.key
          subPath: tls.key
          readOnly: true
{% endif %}
      volumes:
      - name: docker-config
        secret:
          secretName: {{ taskserv.registry_secret | default(value="zot-credentials") }}
          items:
          - key: config.json
            path: config.json
      - name: buildkit-socket
        emptyDir: {}
{% if taskserv.cache.enabled %}
      - name: buildkit-cache
        persistentVolumeClaim:
          claimName: {{ taskserv.deployment }}-cache
{% endif %}
      - name: buildkitd-config
        configMap:
          name: buildkitd-config
{% if taskserv.mtls.enabled %}
      - name: buildkit-mtls-ca
        secret:
          secretName: {{ taskserv.mtls.ca_secret }}
          items:
          - key: ca.crt
            path: ca.crt
      - name: buildkit-mtls-server
        secret:
          secretName: {{ taskserv.mtls.server_cert_secret }}
          items:
          - key: tls.crt
            path: tls.crt
          - key: tls.key
            path: tls.key
{% endif %}