deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "openfga.fullname" . }}
  labels:
    {{- include "openfga.labels" . | nindent 4 }}
  {{- with .Values.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  {{- if not .Values.autoscaling.enabled }}
  replicas: {{ .Values.replicaCount }}
  {{- end }}
  selector:
    matchLabels:
      {{- include "openfga.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      annotations:
      {{- with .Values.podAnnotations }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
        prometheus.io/scrape: "true"
        prometheus.io/path: /metrics
        prometheus.io/port: "{{ (split ":" .Values.telemetry.metrics.addr)._1 }}"
      labels:
        {{- include "openfga.selectorLabels" . | nindent 8 }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "openfga.serviceAccountName" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      {{- if and (has .Values.datastore.engine (list "postgres" "mysql")) .Values.datastore.applyMigrations }}
      initContainers:
        - name: wait-for-migration
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: groundnuty/k8s-wait-for:v1.6
          args: ["job", '{{ include "openfga.fullname" . }}-migrate']
      {{- end }}
      containers:
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          args: ["run"]
          ports:
            - name: grpc
              containerPort: {{ (split ":" .Values.grpc.addr)._1 }}

            - name: http
              containerPort: {{ (split ":" .Values.http.addr)._1 }}
              protocol: TCP

            - name: profiler
              containerPort: {{ (split ":" .Values.profiler.addr)._1 }}
              protocol: TCP

            - name: playground
              containerPort: {{ .Values.playground.port }}
              protocol: TCP

            {{- if .Values.telemetry.metrics.enabled }}
            - name: metrics
              containerPort: {{ (split ":" .Values.telemetry.metrics.addr)._1 }}
              protocol: TCP
            {{- end }}

          env:
            {{- if .Values.datastore.engine }}
            - name: OPENFGA_DATASTORE_ENGINE
              value: "{{ .Values.datastore.engine }}"
            {{- end }}

            {{- if .Values.datastore.uri }}
            - name: OPENFGA_DATASTORE_URI
              value: "{{ .Values.datastore.uri }}"
            {{- else if .Values.datastore.uriSecret }}
            - name: OPENFGA_DATASTORE_URI
              valueFrom:
                secretKeyRef:
                  name: "{{ .Values.datastore.uriSecret }}"
                  key: "uri"
            {{- end }}

            {{- if .Values.datastore.maxCacheSize }}
            - name: OPENFGA_DATASTORE_MAX_CACHE_SIZE
              value: "{{ .Values.datastore.maxCacheSize }}"
            {{- end }}

            {{- if .Values.datastore.maxOpenConns }}
            - name: OPENFGA_DATASTORE_MAX_OPEN_CONNS
              value: "{{ .Values.datastore.maxOpenConns }}"
            {{- end }}

            {{- if .Values.datastore.maxIdleConns }}
            - name: OPENFGA_DATASTORE_MAX_IDLE_CONNS
              value: "{{ .Values.datastore.maxIdleConns }}"
            {{- end }}

            {{- if .Values.datastore.connMaxIdleTime }}
            - name: OPENFGA_DATASTORE_CONN_MAX_IDLE_TIME
              value: "{{ .Values.datastore.connMaxIdleTime }}"
            {{- end }}

            {{- if .Values.datastore.connMaxLifetime }}
            - name: OPENFGA_DATASTORE_CONN_MAX_LIFETIME
              value: "{{ .Values.datastore.connMaxLifetime }}"
            {{- end }}

            {{- if .Values.experimentals }}
            - name: OPENFGA_EXPERIMENTALS
              value: {{ .Values.experimentals }}
            {{- end }}

            {{- if .Values.grpc.addr }}
            - name: OPENFGA_GRPC_ADDR
              value: "{{ .Values.grpc.addr }}"
            {{- end }}

            {{- if .Values.grpc.tls.enabled }}
            - name: OPENFGA_GRPC_TLS_ENABLED
              value: {{ .Values.grpc.tls.enabled }}
            
            - name: OPENFGA_GRPC_TLS_CERT
              value: {{ .Values.grpc.tls.cert }}

            - name: OPENFGA_GRPC_TLS_KEY
              value: {{ .Values.grpc.tls.key }}
            {{- end }}

            {{- if .Values.http.enabled }}
            - name: OPENFGA_HTTP_ENABLED
              value: "{{ .Values.http.enabled }}"
            {{- end }}

            {{- if .Values.http.addr }}
            - name: OPENFGA_HTTP_ADDR
              value: "{{ .Values.http.addr }}"
            {{- end }}

            {{- if .Values.http.tls.enabled }}
            - name: OPENFGA_HTTP_TLS_ENABLED
              value: "{{ .Values.http.tls.enabled }}"

            - name: OPENFGA_HTTP_TLS_CERT
              value: {{ .Values.http.tls.cert }}
            
            - name: OPENFGA_HTTP_TLS_KEY
              value: {{ .Values.http.tls.key }}
            {{- end }}

            {{- if .Values.http.upstreamTimeout }}
            - name: OPENFGA_HTTP_UPSTREAM_TIMEOUT
              value: "{{ .Values.http.upstreamTimeout }}"
            {{- end }}

            {{- if .Values.http.corsAllowedOrigins }}
            - name: OPENFGA_HTTP_CORS_ALLOWED_ORIGINS
              value: "{{ join "," .Values.http.corsAllowedOrigins }}"
            {{- end }}

            {{- if .Values.http.corsAllowedHeaders }}
            - name: OPENFGA_HTTP_CORS_ALLOWED_HEADERS
              value: "{{ join "," .Values.http.corsAllowedHeaders }}"
            {{- end }}

            {{- if .Values.authn.method }}
            - name: OPENFGA_AUTHN_METHOD
              value: {{ .Values.authn.method }}
            {{- end }}

            {{- if .Values.authn.preshared.keys }}
            - name: OPENFGA_AUTHN_PRESHARED_KEYS
              value: "{{ join "," .Values.authn.preshared.keys }}"
            {{- end }}

            {{- if .Values.authn.oidc.audience }}
            - name: OPENFGA_AUTHN_OIDC_AUDIENCE
              value: {{ .Values.authn.oidc.audience }}
            {{- end }}

            {{- if .Values.authn.oidc.issuer }}
            - name: OPENFGA_AUTHN_OIDC_ISSUER
              value: {{ .Values.authn.oidc.issuer }}
            {{- end }}

            - name: OPENFGA_PLAYGROUND_ENABLED
              value: "{{ .Values.playground.enabled }}"
            - name: OPENFGA_PLAYGROUND_PORT
              value: "{{ .Values.playground.port }}"

            {{- if .Values.profiler.enabled }}
            - name: OPENFGA_PROFILER_ENABLED
              value: "{{ .Values.profiler.enabled }}"
            {{- end }}

            {{- if .Values.log.format }}
            - name: OPENFGA_LOG_FORMAT
              value: {{ .Values.log.format }}
            {{- end }}

            {{- if .Values.log.level }}
            - name: OPENFGA_LOG_LEVEL
              value: {{ .Values.log.level }}
            {{- end }}

            {{- if .Values.maxTuplesPerWrite }}
            - name: OPENFGA_MAX_TUPLES_PER_WRITE
              value: "{{ .Values.maxTuplesPerWrite }}"
            {{- end }}

            {{- if .Values.maxTypesPerAuthorizationModel }}
            - name: OPENFGA_MAX_TYPES_PER_AUTHORIZATION_MODEL
              value: "{{ .Values.maxTypesPerAuthorizationModel }}"
            {{- end }}

            {{- if .Values.changelogHorizonOffset }}
            - name: OPENFGA_CHANGELOG_HORIZON_OFFSET
              value: "{{ .Values.changelogHorizonOffset }}"
            {{- end }}

            {{- if .Values.resolveNodeLimit }}
            - name: OPENFGA_RESOLVE_NODE_LIMIT
              value: "{{ .Values.resolveNodeLimit }}"
            {{- end }}

            {{- if .Values.listObjectsDeadline }}
            - name: OPENFGA_LIST_OBJECTS_DEADLINE
              value: "{{ .Values.listObjectsDeadline }}"
            {{- end }}

            {{- if .Values.listObjectsMaxResults }}
            - name: OPENFGA_LIST_OBJECTS_MAX_RESULTS
              value: "{{ .Values.listObjectsMaxResults }}"
            {{- end }}

            {{- if .Values.allowWriting1_0Models }}
            - name: OPENFGA_ALLOW_WRITING_1_0_MODELS
              value: "{{ .Values.allowWriting1_0Models }}"
            {{- end }}

            {{- if .Values.allowEvaluating1_0Models }}
            - name: OPENFGA_ALLOW_EVALUATING_1_0_MODELS
              value: "{{ .Values.allowEvaluating1_0Models }}"
            {{- end }}

            {{- if .Values.telemetry.metrics.enabled }}
            - name: OPENFGA_METRICS_ENABLED
              value: "{{ .Values.telemetry.metrics.enabled }}"
            {{- end }}

            {{- if .Values.telemetry.metrics.addr }}
            - name: OPENFGA_METRICS_ADDR
              value: "{{ .Values.telemetry.metrics.addr }}"
            {{- end }}

            {{- if .Values.telemetry.metrics.enableRPCHistograms }}
            - name: OPENFGA_METRICS_ENABLE_RPC_HISTOGRAMS
              value: "{{ .Values.telemetry.metrics.enableRPCHistograms }}"
            {{- end }}

            {{- if .Values.telemetry.trace.enabled }}
            - name: OPENFGA_TRACE_ENABLED
              value: "{{ .Values.telemetry.trace.enabled }}"
            {{- end }}

            {{- if .Values.telemetry.trace.otlp.endpoint }}
            - name: OPENFGA_TRACE_OTLP_ENDPOINT
              value: {{ .Values.telemetry.trace.otlp.endpoint }}
            {{- end }}

            {{- if .Values.telemetry.trace.sampleRatio }}
            - name: OPENFGA_TRACE_SAMPLE_RATIO
              value: "{{ .Values.telemetry.trace.sampleRatio }}"
            {{- end }}

          {{- if .Values.customReadinessProbe }}
          readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
          {{- else if .Values.readinessProbe.enabled }}
          readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readinessProbe "enabled") "context" $) | nindent 12 }}
            exec:
              command: ["grpc_health_probe", "-addr={{ .Values.grpc.addr }}"]
          {{- end }}

          {{- if .Values.customLivenessProbe }}
          livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
          {{- else if .Values.livenessProbe.enabled }}
          livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.livenessProbe "enabled") "context" $) | nindent 12 }}
            grpc:
              port: {{ (split ":" .Values.grpc.addr)._1 }}
          {{- end }}

          {{- if .Values.customStartupProbe }}
          startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
          {{- else if .Values.startupProbe.enabled }}
          startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }}
            grpc:
              port: {{ (split ":" .Values.grpc.addr)._1 }}
          {{- end }}

          resources:
            {{- toYaml .Values.resources | nindent 12 }}
        {{- if .Values.sidecars }}
        {{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }}
        {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}