apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: zot
  namespace: {{ taskserv.namespace | default(value="registry") }}
  labels:
    app.kubernetes.io/name: zot
    app.kubernetes.io/managed-by: provisioning
spec:
  serviceName: zot
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: zot
  template:
    metadata:
      labels:
        app.kubernetes.io/name: zot
    spec:
      containers:
        - name: zot
          image: {{ taskserv.image | default(value="ghcr.io/project-zot/zot-linux-arm64:v2.1.18") }}
          args: ["serve", "/etc/zot/config.json"]
          ports:
            - containerPort: {{ taskserv.port | default(value=5000) }}
              name: registry
          env:
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: zot-s3-credentials
                  key: access_key
            - name: AWS_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: zot-s3-credentials
                  key: secret_key
            - name: AWS_REGION
              value: "{{ taskserv.storage_backend.region | default(value="eu-central-1") }}"
          volumeMounts:
            - name: config
              mountPath: /etc/zot/config.json
              subPath: config.json
              readOnly: true
            - name: data
              mountPath: {{ taskserv.data_dir | default(value="/var/lib/data/zot") }}
{%- if taskserv.auth_enabled is defined and taskserv.auth_enabled %}
            - name: auth
              mountPath: /etc/zot/htpasswd
              subPath: htpasswd
              readOnly: true
{%- endif %}
{%- if taskserv.pod_tls is defined and taskserv.pod_tls and taskserv.tls_secret is defined %}
            - name: tls
              mountPath: /etc/zot/ssl
              readOnly: true
{%- endif %}
{%- if taskserv.sync_upstream is defined %}
            - name: sync-creds
              mountPath: /etc/zot/sync-creds.json
              subPath: sync-creds.json
              readOnly: true
{%- endif %}
          # startupProbe shields the container while zot parses its storage on boot
          # (metadb scan of all repos). Without it a slow start is killed by the
          # liveness probe → crashloop → re-parse → never ready. 60×10s = 10min grace.
          startupProbe:
            tcpSocket:
              port: {{ taskserv.port | default(value=5000) }}
            periodSeconds: 10
            failureThreshold: 60
            timeoutSeconds: 5
          readinessProbe:
            tcpSocket:
              port: {{ taskserv.port | default(value=5000) }}
            initialDelaySeconds: 15
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 6
          livenessProbe:
            tcpSocket:
              port: {{ taskserv.port | default(value=5000) }}
            initialDelaySeconds: 30
            periodSeconds: 20
            timeoutSeconds: 5
            failureThreshold: 6
      volumes:
        - name: config
          configMap:
            name: zot-config
        - name: data
          persistentVolumeClaim:
            claimName: zot-data
{%- if taskserv.auth_enabled is defined and taskserv.auth_enabled %}
        - name: auth
          secret:
            secretName: zot-auth
            items:
              - key: htpasswd
                path: htpasswd
{%- endif %}
{%- if taskserv.pod_tls is defined and taskserv.pod_tls and taskserv.tls_secret is defined %}
        - name: tls
          secret:
            secretName: {{ taskserv.tls_secret }}
            items:
              - key: tls.crt
                path: tls.crt
              - key: tls.key
                path: tls.key
{%- endif %}
{%- if taskserv.sync_upstream is defined %}
        - name: sync-creds
          secret:
            secretName: zot-sync-creds
            items:
              - key: sync-creds.json
                path: sync-creds.json
{%- endif %}