apiVersion: v1
kind: Pod
metadata:
  name: "{{pod_name}}"
spec:
  {{#if runtimeClass}}
  runtimeClassName: {{runtimeClass}}
  {{/if}}
  serviceAccountName: {{service_account}}
  automountServiceAccountToken: {{automount_service_account_token}}
  terminationGracePeriodSeconds: {{termination_grace_period_seconds}}
  restartPolicy: Never
  dnsPolicy: {{dns_policy}}
  {{#if imagePullSecretName}}
  imagePullSecrets:
  - name: {{imagePullSecretName}}
  {{/if}}
  containers:
  - name: "{{build_id_with_prefix}}"
    image: {{container}}
    imagePullPolicy: {{image_pull_policy}}
    securityContext:
      privileged: {{privileged}}
    resources:
      limits:
        cpu: {{cpu}}m
        memory: {{memory}}Gi
    env:
      - name: SD_HAB_ENABLED
        value: "{{sd_hab_enabled}}"
      - name: SD_RUNTIME_CLASS
        value: {{runtimeClass}}
      - name: SD_PUSHGATEWAY_URL
        value: {{pushgateway_url}}
      - name: SD_TERMINATION_GRACE_PERIOD_SECONDS
        value: "{{termination_grace_period_seconds}}"
      - name: CONTAINER_IMAGE
        value: {{container}}
      - name: SD_PIPELINE_ID
        value: "{{pipeline_id}}"
      - name: SD_BUILD_PREFIX
        value: "{{prefix}}"
      - name: NODE_ID
        valueFrom:
          fieldRef:
            fieldPath: spec.nodeName
      - name: SD_BASE_COMMAND_PATH
        value: "/sd/commands/"
      - name: SD_TEMP
        value: "/opt/sd_tmp"
      - name: CONTAINER_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            containerName: "{{build_id_with_prefix}}"
            resource: limits.cpu
      - name: CONTAINER_MEMORY_LIMIT
        valueFrom:
          resourceFieldRef:
            containerName: "{{build_id_with_prefix}}"
            resource: limits.memory
    {{#if docker.enabled}}
      - name: SD_DIND_SHARE_PATH
        value: "/opt/sd_dind_share"
      - name: DOCKER_HOST
        value: tcp://localhost:2376
      - name: DOCKER_CERT_PATH
        value: /certs/client
      - name: DOCKER_TLS_VERIFY
        value: "1"
    {{/if}}
    {{#unless secret_entity.disabled}}
      {{#each secret_entity.secrets}}
      - name: {{this.secret_env}}
        valueFrom:
          secretKeyRef:
            name: {{this.secret_name}}
            key: {{this.secret_key}}
      {{/each}}
    {{/unless}}
    command:
    - "/opt/sd/launcher_entrypoint.sh"
    args:
    # Run the wrapper script
    - |
    {{#if cache.diskEnabled}}
      /opt/sd/run.sh "{{token}}" "{{api_uri}}" "{{store_uri}}" "{{build_timeout}}" "{{build_id}}" "{{ui_uri}}" "{{cache.strategy}}" "/sdpipelinecache" "/sdjobcache" "/sdeventcache" "{{cache.compress}}" "{{cache.md5check}}" "{{cache.max_size_mb}}" "{{cache.max_go_threads}}"
    {{else}}
      /opt/sd/run.sh "{{token}}" "{{api_uri}}" "{{store_uri}}" "{{build_timeout}}" "{{build_id}}" "{{ui_uri}}"
    {{/if}}
    volumeMounts:
    - name: podinfo
      mountPath: /etc/podinfo
      readOnly: true
    - mountPath: /opt/sd
      name: screwdriver
      readOnly: true
    - mountPath: /opt/sd_tmp
      name: sdtemp
    - mountPath: /workspace
      name: workspace
    {{#if docker.enabled}}
    - name: dind-share
      mountPath: /opt/sd_dind_share
    - name: dind-client-certs
      mountPath: /certs/client
    {{/if}}
    {{#if rootlessbuildkit.enabled}}
    - name: buildkit-client-certs
      mountPath: /certs/buildkit/client
    {{/if}}
    {{#if cache.diskEnabled}}
    - mountPath: /sdpipelinecache
      name: sd-pipeline-cache
      readOnly: {{cache.volumeReadOnly}}
    - mountPath: /sdjobcache
      name: sd-job-cache
      readOnly: {{cache.volumeReadOnly}}
    - mountPath: /sdeventcache
      name: sd-event-cache
    {{/if}}
    {{#each volume_mounts}}
    - mountPath: {{this.mountPath}}
      name: {{this.name}}
      readOnly: {{this.readOnly}}
    {{/each}}
  {{#unless secret_file_entity.disabled}}
    {{#each secret_file_entity.secrets}}
    - mountPath: {{this.mountPath}}
      name: {{this.name}}
      readOnly: {{this.readOnly}}
    {{/each}}
  {{/unless}}
  {{#if docker.enabled}}
  - name: dind
    {{#if rootlessbuildkit.enabled}}
    image: docker:20.10-dind-rootless
    {{else}}
    image: docker:20.10-dind
    {{/if}}
    resources:
      limits:
        cpu: {{docker.cpu }}m
        memory: {{docker.memory }}Gi
    securityContext:
      privileged: true
    volumeMounts:
      - name: dind-storage
        mountPath: /var/lib/docker
      - name: dind-share
        mountPath: /opt/sd_dind_share
      - name: dind-client-certs
        mountPath: /certs/client
  {{/if}}
  {{#if rootlessbuildkit.enabled}}
  - name: buildkitd
    image: screwdrivercd/buildkit-rootless:latest
    resources:
      limits:
        cpu: {{rootlessbuildkit.cpu}}m
        memory: {{rootlessbuildkit.memory}}Gi
    args:
      - --addr
      - tcp://localhost:1234
      - --config
      - /etc/buildkit/buildkitd.toml
    securityContext:
      privileged: true
    volumeMounts:
    - name: buildkit-client-certs
      mountPath: /certs/buildkit/client
    - name: buildkit-server-certs
      mountPath: /certs/buildkit/server
  {{/if}}
  initContainers:
  - name: "launcher-{{build_id_with_prefix}}"
    image: {{launcher_image}}
    {{#if cache.diskEnabled}}
    command: ['/bin/sh', '-c', 'echo launcher_start_ts:`date "+%s"` > /workspace/metrics && chmod -R 777 /opt/sdpipelinecache && chmod -R 777 /opt/sdjobcache && chmod -R 777 /opt/sdeventcache && if ! [ -f /opt/launcher/launch ]; then TEMP_DIR=`mktemp -d -p /opt/launcher` && cp -a /opt/sd/* $TEMP_DIR && mkdir -p $TEMP_DIR/hab && cp -a /hab/. $TEMP_DIR/hab && mv -fn $TEMP_DIR/* /opt/launcher && rm -rf $TEMP_DIR || true; else ls /opt/launcher; fi; echo launcher_end_ts:`date "+%s"` >> /workspace/metrics']
    {{else}}
    command: ['/bin/sh', '-c', 'echo launcher_start_ts:`date "+%s"` > /workspace/metrics && if ! [ -f /opt/launcher/launch ]; then TEMP_DIR=`mktemp -d -p /opt/launcher` && cp -a /opt/sd/* $TEMP_DIR && mkdir -p $TEMP_DIR/hab && cp -a /hab/. $TEMP_DIR/hab && mv -fn $TEMP_DIR/* /opt/launcher && rm -rf $TEMP_DIR || true; else ls /opt/launcher; fi; echo launcher_end_ts:`date "+%s"` >> /workspace/metrics']
    {{/if}}
    volumeMounts:
    - mountPath: /opt/launcher
      name: screwdriver
    - mountPath: /workspace
      name: workspace
    {{#if cache.diskEnabled}}
    - mountPath: /opt/sdpipelinecache
      name: sd-pipeline-cache
    - mountPath: /opt/sdjobcache
      name: sd-job-cache
    - mountPath: /opt/sdeventcache
      name: sd-event-cache
    {{/if}}
  volumes:
    - name: podinfo
      downwardAPI:
        items:
          - path: "labels"
            fieldRef:
              fieldPath: metadata.labels
          - path: "annotations"
            fieldRef:
              fieldPath: metadata.annotations
    - name: screwdriver
      type: DirectoryOrCreate
      hostPath:
        path: /opt/screwdriver/sdlauncher/{{launcher_version}}
    - name: sdtemp
      type: DirectoryOrCreate
      hostPath:
        path: /opt/screwdriver/tmp_{{build_id}}
    - name: workspace
      emptyDir: {}
    {{#if docker.enabled}}
    - name: dind-storage
      emptyDir: {}
    - name: dind-share
      emptyDir: {}
    - name: dind-client-certs
      emptyDir: {}
    {{/if}}
    {{#if rootlessbuildkit.enabled}}
    - name: buildkit-client-certs
      emptyDir: {}
    - name: buildkit-server-certs
      emptyDir: {}
    {{/if}}
    {{#if cache.diskEnabled}}
    - name: sd-pipeline-cache
      type: DirectoryOrCreate
      hostPath:
        path: {{cache.path}}/pipelines/{{pipeline_id}}
    - name: sd-job-cache
      type: DirectoryOrCreate
      hostPath:
        path: {{cache.path}}/jobs/{{pipeline_id}}/{{job_id}}
    - name: sd-event-cache
      type: DirectoryOrCreate
      hostPath:
        path: {{cache.path}}/events/{{pipeline_id}}/{{event_id}}
    {{/if}}
    {{#each volume_mounts}}
    - name: {{this.name}}
      hostPath:
        path: {{this.path}}
        type: {{this.type}}
    {{/each}}
  {{#unless secret_file_entity.disabled}}
    {{#each secret_file_entity.secrets}}
    - name: {{this.name}}
      secret:
        secretName: {{this.secretName}}
    {{/each}}
  {{/unless}}