{{- if include "auth.create" . }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: traefik-forward-auth
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "common.labels" . | nindent 4 }}
  annotations:
    {{- include "common.annotations" . | nindent 4 }}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik-forward-auth
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: traefik-forward-auth
    spec:
      terminationGracePeriodSeconds: 60
      containers:
        - image: thomseddon/traefik-forward-auth:2
          imagePullPolicy: Always
          name: traefik-forward-auth
          ports:
            - name: auth
              containerPort: 4181
              protocol: TCP
          env:
            - name: CONFIG
              value: "/config"
            - name: PROVIDERS_GOOGLE_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: traefik-forward-auth-secrets
                  key: google-client-id
            - name: PROVIDERS_GOOGLE_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: traefik-forward-auth-secrets
                  key: google-client-secret
            - name: SECRET
              valueFrom:
                secretKeyRef:
                  name: traefik-forward-auth-secrets
                  key: secret
          volumeMounts:
            - name: config
              mountPath: /config
              subPath: traefik-forward-auth.ini
      volumes:
        - name: config
          configMap:
            name: traefik-forward-auth
        - name: traefik-forward-auth-secrets
          secret:
            secretName: traefik-forward-auth-secrets
{{- end }}