{{- template "check-version" . }}
{{- if .Values.agents.enabled }}
{{- if (or (.Values.datadog.apiKeyExistingSecret) (.Values.datadog.apiKey)) }}
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: {{ template "datadog.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "datadog.labels" . | indent 4 }}
    app.kubernetes.io/component: agent
    {{- if .Values.agents.additionalLabels }}
{{ toYaml .Values.agents.additionalLabels | indent 4 }}
    {{- end }}
{{ include "provider-labels" . | indent 4 }}
spec:
  selector:
    matchLabels:
      app: {{ template "datadog.fullname" . }}
        {{- if .Values.agents.podLabels }}
{{ toYaml .Values.agents.podLabels | indent 6 }}
        {{- end }}
  template:
    metadata:
      labels:
{{ include "datadog.template-labels" . | indent 8 }}
        app.kubernetes.io/component: agent
        app: {{ template "datadog.fullname" . }}
        {{- if .Values.agents.podLabels }}
{{ toYaml .Values.agents.podLabels | indent 8 }}
        {{- end }}
        {{- if .Values.agents.additionalLabels }}
{{ toYaml .Values.agents.additionalLabels | indent 8 }}
        {{- end }}
{{ (include "provider-labels" .) | indent 8 }}
      name: {{ template "datadog.fullname" . }}
      annotations:
        checksum/clusteragent_token: {{ include (print $.Template.BasePath "/secret-cluster-agent-token.yaml") . | sha256sum }}
        {{- if not .Values.datadog.apiKeyExistingSecret }}
        checksum/api_key: {{ include (print $.Template.BasePath "/secret-api-key.yaml") . | sha256sum }}
        {{- end }}
        checksum/install_info: {{ printf "%s-%s" .Chart.Name .Chart.Version | sha256sum }}
        checksum/autoconf-config: {{ tpl (toYaml .Values.datadog.autoconf) . | sha256sum }}
        checksum/confd-config: {{ tpl (toYaml .Values.datadog.confd) . | sha256sum }}
        checksum/checksd-config: {{ tpl (toYaml .Values.datadog.checksd) . | sha256sum }}
        {{- if .Values.agents.customAgentConfig }}
        checksum/agent-config: {{ tpl (toYaml .Values.agents.customAgentConfig) . | sha256sum }}
        {{- end }}
        {{- if eq  (include "should-enable-system-probe" .) "true" }}
        {{- if .Values.agents.podSecurity.apparmor.enabled }}
        container.apparmor.security.beta.kubernetes.io/system-probe: {{ .Values.datadog.systemProbe.apparmor }}
        {{- end }}
        container.seccomp.security.alpha.kubernetes.io/system-probe: {{ .Values.datadog.systemProbe.seccomp }}
        {{- end }}
      {{- if .Values.agents.podAnnotations }}
{{ tpl (toYaml .Values.agents.podAnnotations) . | indent 8 }}
      {{- end }}
    spec:
      {{- if .Values.datadog.securityContext }}
      securityContext:
{{ toYaml .Values.datadog.securityContext| indent 8 }}
      {{- else if or .Values.agents.podSecurity.podSecurityPolicy.create .Values.agents.podSecurity.securityContextConstraints.create -}}
      {{- if .Values.agents.podSecurity.securityContext }}
      {{- if .Values.agents.podSecurity.securityContext.seLinuxOptions }}
      securityContext:
        seLinuxOptions:
{{ toYaml .Values.agents.podSecurity.securityContext.seLinuxOptions | indent 10 }}
      {{- end }}
      {{- else if .Values.agents.podSecurity.seLinuxContext }}
      {{- if .Values.agents.podSecurity.seLinuxContext.seLinuxOptions }}
      securityContext:
        seLinuxOptions:
{{ toYaml .Values.agents.podSecurity.seLinuxContext.seLinuxOptions | indent 10 }}
      {{- end }}
      {{- end }}
      {{- else if eq  (include "is-openshift" .) "true"}}
      securityContext:
        seLinuxOptions:
          user: "system_u"
          role: "system_r"
          type: "spc_t"
          level: "s0"
      {{- end }}
      {{- if .Values.agents.useHostNetwork }}
      hostNetwork: {{ .Values.agents.useHostNetwork }}
      dnsPolicy: ClusterFirstWithHostNet
      {{- end }}
      {{- if .Values.agents.dnsConfig }}
      dnsConfig:
{{ toYaml .Values.agents.dnsConfig | indent 8 }}
      {{- end }}
      {{- if or (eq  (include "should-enable-compliance" .) "true") .Values.datadog.dogstatsd.useHostPID }}
      hostPID: true
      {{- end }}
      {{- if .Values.agents.image.pullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.agents.image.pullSecrets | indent 8 }}
      {{- end }}
      {{- if .Values.agents.priorityClassName }}
      priorityClassName: {{ .Values.agents.priorityClassName }}
      {{- end }}
      containers:
        {{- include "container-agent" . | nindent 6 }}
        {{- if eq (include "should-enable-trace-agent" .) "true" }}
          {{- include "container-trace-agent" . | nindent 6 }}
        {{- end }}
        {{- if .Values.datadog.processAgent.enabled }}
          {{- include "container-process-agent" . | nindent 6 }}
        {{- end }}
        {{- if eq (include "should-enable-system-probe" .) "true" }}
          {{- include "container-system-probe" . | nindent 6 }}
        {{- end }}
        {{- if eq  (include "should-enable-security-agent" .) "true" }}
          {{- include "container-security-agent" . | nindent 6 }}
        {{- end }}
      initContainers:
        {{- if eq .Values.targetSystem "windows" }}
          {{ include "containers-init-windows" . | nindent 6 }}
        {{- end }}
        {{- if eq .Values.targetSystem "linux" }}
          {{ include "containers-init-linux" . | nindent 6 }}
        {{- end }}
        {{- if and (eq (include "should-enable-system-probe" .) "true")  (eq .Values.datadog.systemProbe.seccomp "localhost/system-probe") }}
          {{ include "system-probe-init" . | nindent 6 }}
        {{- end }}
      volumes:
      - name: installinfo
        configMap:
          name: {{ template "datadog.fullname" . }}-installinfo
      - name: config
        emptyDir: {}
      {{- if .Values.datadog.checksd }}
      - name: checksd
        configMap:
          name: {{ template "datadog.fullname" . }}-checksd
      {{- end }}
      {{- if .Values.agents.useConfigMap }}
      - name: {{ template "datadog.fullname" . }}-datadog-yaml
        configMap:
          name: {{ template "datadog.fullname" . }}-datadog-yaml
      {{- end }}
      {{- if eq .Values.targetSystem "windows" }}
        {{ include "daemonset-volumes-windows" . | nindent 6 }}
      {{- end }}
      {{- if eq .Values.targetSystem "linux" }}
        {{ include "daemonset-volumes-linux" . | nindent 6 }}
      {{- end }}
{{- if .Values.agents.volumes }}
{{ toYaml .Values.agents.volumes | indent 6 }}
{{- end }}
      tolerations:
      {{- if eq .Values.targetSystem "windows" }}
      - effect: NoSchedule
        key: node.kubernetes.io/os
        value: windows
        operator: Equal
      {{- end }}
      {{- if .Values.agents.tolerations }}
{{ toYaml .Values.agents.tolerations | indent 6 }}
      {{- end }}
      affinity:
{{ toYaml .Values.agents.affinity | indent 8 }}
      serviceAccountName: {{ if .Values.agents.rbac.create }}{{ template "datadog.fullname" . }}{{ else }}"{{ .Values.agents.rbac.serviceAccountName }}"{{ end }}
      nodeSelector:
        {{ template "label.os" . }}: {{ .Values.targetSystem }}
      {{- if .Values.agents.nodeSelector }}
{{ toYaml .Values.agents.nodeSelector | indent 8 }}
      {{- end }}
  updateStrategy:
{{ toYaml .Values.agents.updateStrategy | indent 4 }}
{{ end }}
{{ end }}
