{{- $root := . -}}
{{- $gimg := $root.Values.global.image | default dict -}}
{{- $globalPull := $gimg.pullPolicy | default "" | toString | trim }}
{{- range $compName, $comp := .Values.components }}
{{- $imageTag := include "certs-ui.component.imageTag" (dict "root" $root "comp" $comp) }}
{{- $compPull := $comp.image.pullPolicy | default "" | toString | trim }}
{{- $pullRaw := ternary $globalPull $compPull (ne $globalPull "") }}
{{- $pullPolicy := include "certs-ui.normalizePullPolicy" (default "IfNotPresent" $pullRaw) | trim }}
{{- $alwaysPull := eq $pullPolicy "Always" }}
{{- $rollEpoch := now | unixEpoch | toString }}
{{- $rollRev := $root.Release.Revision | toString }}
{{- $rollPin := $root.Values.global.rollme | default "" | toString | trim }}
{{- $rollNonce := $root.Values.global.rolloutNonce | default "" | toString | trim }}
{{- /* rollPin wins; else nonce-epoch for CI; else release revision + epoch (helm upgrade bumps revision; re-render bumps epoch). */ -}}
{{- $rollmeVal := ternary $rollPin (ternary (printf "%s-%s" $rollNonce $rollEpoch) (printf "r%s-%s" $rollRev $rollEpoch) (ne $rollNonce "")) (ne $rollPin "") }}
{{- $cf := default dict $comp.configMapFile }}
{{- $sf := default dict $comp.secretsFile }}
{{- $cmName := ternary $cf.existingConfigMap (printf "%s-%s-configmap" (include "certs-ui.fullname" $root) $compName) (ne ($cf.existingConfigMap | default "") "") }}
{{- $secretName := ternary $sf.existingSecret (printf "%s-%s-secrets" (include "certs-ui.fullname" $root) $compName) (ne ($sf.existingSecret | default "") "") }}
{{- $hasCm := or (ne ($cf.existingConfigMap | default "") "") (and $cf.key (hasKey $cf "content")) }}
{{- $hasSecret := or (ne ($sf.existingSecret | default "") "") (and $sf.key (hasKey $sf "content")) }}
{{- $svc := default dict $comp.service }}
{{- $tgt := default 8080 $svc.targetPort }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "certs-ui.fullname" $root }}-{{ $compName }}
  namespace: {{ $root.Release.Namespace }}
  labels:
    {{- include "certs-ui.labels" $root | nindent 4 }}
    app.kubernetes.io/component: {{ $compName }}
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app.kubernetes.io/instance: {{ $root.Release.Name }}
      app.kubernetes.io/name: {{ include "certs-ui.name" $root }}
      app.kubernetes.io/component: {{ $compName }}
  template:
    metadata:
      labels:
{{ include "certs-ui.podLabels" (dict "root" $root "component" $compName "imageTag" $imageTag) | indent 8 }}
      annotations:
        {{- /* With Always: changing rollme forces a rollout so new pods run imagePullPolicy Always against the registry (same tag). Pin global.rollme for stable manifests. */ -}}
        {{- if $alwaysPull }}
        rollme: {{ $rollmeVal | quote }}
        {{- end }}
        certs-ui.io/image: {{ printf "%s/%s:%s" $comp.image.registry $comp.image.repository $imageTag | quote }}
    spec:
      {{- include "certs-ui.imagePullSecrets" $root | nindent 6 }}
      containers:
        - name: {{ $compName }}
          image: "{{ $comp.image.registry }}/{{ $comp.image.repository }}:{{ $imageTag }}"
          imagePullPolicy: {{ $pullPolicy }}
          ports:
            - name: http
              containerPort: {{ $tgt }}
          {{- if $comp.env }}
          env:
            {{- range $comp.env }}
            - name: {{ .name }}
              value: {{ .value | quote }}
            {{- end }}
          {{- end }}
          {{- with $comp.livenessProbe }}
          livenessProbe:
{{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with $comp.readinessProbe }}
          readinessProbe:
{{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with $comp.resources }}
          resources:
{{- toYaml . | nindent 12 }}
          {{- end }}
          {{- $p := default dict $comp.persistence -}}
          {{- $vols := default (list) $p.volumes -}}
          {{- $hasVols := gt (len $vols) 0 -}}
          {{- if or $hasVols $hasSecret $hasCm }}
          volumeMounts:
            {{- range $vol := $vols }}
            - name: {{ $compName }}-{{ $vol.name }}
              mountPath: {{ $vol.mountPath }}
            {{- end }}
            {{- if $hasSecret }}
            - name: {{ $compName }}-secrets
              mountPath: {{ $sf.mountPath }}
              subPath: {{ base $sf.mountPath }}
              readOnly: true
            {{- end }}
            {{- if $hasCm }}
            - name: {{ $compName }}-configmap
              mountPath: {{ $cf.mountPath }}
              subPath: {{ base $cf.mountPath }}
              readOnly: true
            {{- end }}
          {{- end }}
      {{- if or $hasVols $hasSecret $hasCm }}
      volumes:
        {{- range $vol := $vols }}
        - name: {{ $compName }}-{{ $vol.name }}
          {{- if eq $vol.type "pvc" }}
          persistentVolumeClaim:
            claimName: {{ include "certs-ui.fullname" $root }}-{{ $compName }}-{{ $vol.name }}
          {{- else if eq $vol.type "emptyDir" }}
          emptyDir: {{ toYaml (default dict $vol.emptyDir) | nindent 12 }}
          {{- else }}
          emptyDir: {}
          {{- end }}
        {{- end }}
        {{- if $hasSecret }}
        - name: {{ $compName }}-secrets
          secret:
            secretName: {{ $secretName }}
            items:
              - key: {{ $sf.key }}
                path: {{ base $sf.mountPath }}
        {{- end }}
        {{- if $hasCm }}
        - name: {{ $compName }}-configmap
          configMap:
            name: {{ $cmName }}
            items:
              - key: {{ $cf.key }}
                path: {{ base $cf.mountPath }}
        {{- end }}
      {{- end }}
{{- end }}
