onechart/charts/onechart/templates/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "robustName" .Release.Name }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "helm-chart.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicas }}
  selector:
    matchLabels:
      {{- include "helm-chart.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        {{- with .Values.podAnnotations }}
          {{- toYaml . | nindent 8 }}
        {{- end }}
      labels:
        {{- include "helm-chart.selectorLabels" . | nindent 8 }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
        - name: {{ template "robustName" .Release.Name }}
          securityContext: &securityContext
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          {{- if .Values.command }}
          command:
            - {{ .Values.shell }}
            - -c
            - {{ .Values.command | quote }}
          {{- end }}
          {{- if or (or (.Values.vars) (.Values.secretEnabled)) .Values.sealedSecrets }}
          envFrom: &envFrom
            {{- if .Values.vars }}
            - configMapRef:
                name: {{ template "robustName" .Release.Name }}
            {{- end }}
            {{- if .Values.secretEnabled }}
            - secretRef:
                name: {{ .Values.secretName | default (include "robustName" $.Release.Name) }}
            {{- end }}
            {{- if .Values.sealedSecrets }}
            - secretRef:
                name: {{ template "robustName" .Release.Name }}
            {{- end }}
          {{- end }}
          ports:
            - name: http
              containerPort: {{ .Values.containerPort }}
              protocol: TCP
          {{- if .Values.probe.enabled }}
          readinessProbe:
            httpGet:
              path: {{ .Values.probe.path }}
              port: {{ .Values.containerPort }}
              scheme: HTTP
            {{- with .Values.probe.settings }}
            {{- toYaml . | nindent 12 }}
            {{- end }}
          {{- end }}
          {{- if or (or (.Values.volumes) (.Values.sealedFileSecrets)) .Values.fileSecrets }}
          volumeMounts: &volumeMounts
            {{- range .Values.volumes }}
            - name: {{ .name }}
              mountPath: {{ .path }}
            {{- end }}
            {{- range .Values.sealedFileSecrets }}
            - name: {{ .name }}
              mountPath: {{ .path }}
              readOnly: true
            {{- end }}
            {{- range .Values.fileSecrets }}
            - name: {{ .name }}
              mountPath: {{ .path }}
              readOnly: true
            {{- end }}
          {{- end }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
        {{- if .Values.debugSidecarEnabled }}
        - name: {{ template "robustName" .Release.Name }}-debug
          securityContext: *securityContext
          image: {{ .Values.debugSidecar.image }}
          command:
            - {{ .Values.debugSidecar.shell }}
            - -c
            - {{ .Values.debugSidecar.command | quote }}
          {{- if or (or (.Values.vars) (.Values.secretEnabled)) .Values.sealedSecrets }}
          envFrom: *envFrom
          {{- end }}
          {{- if or (or (.Values.volumes) (.Values.sealedFileSecrets)) .Values.fileSecrets }}
          volumeMounts: *volumeMounts
          {{- end }}
        {{- end }}
      {{- if or (or (.Values.volumes) (.Values.sealedFileSecrets)) .Values.fileSecrets }}
      volumes:
        {{- range .Values.volumes }}
        - name: {{ .name }}
          persistentVolumeClaim:
            claimName: {{ printf "%s-%s" $.Release.Name .name }}
        {{- end }}
        {{- range .Values.sealedFileSecrets }}
        - name: {{ .name }}
          secret:
            secretName: {{ printf "%s-%s" $.Release.Name .name }}
        {{- end }}
        {{- range .Values.fileSecrets }}
        - name: {{ .name }}
          secret:
            secretName: {{ printf "%s-%s" $.Release.Name .name }}
        {{- end }}
      {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- if or .Values.spreadAcrossNodes .Values.affinity }}
      affinity:
        {{- if .Values.spreadAcrossNodes }}
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: "app.kubernetes.io/instance"
                    operator: In
                    values:
                      - {{ template "robustName" .Release.Name }}
              topologyKey: "kubernetes.io/hostname"
        {{- end }}
        {{- if .Values.affinity }}
        {{- toYaml .Values.affinity | nindent 8 }}
        {{- end }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}