locals {
  dashboards = { for file in fileset("./resources/chronograf/dashboards", "*.dashboard") : file => file("./resources/chronograf/dashboards/${file}") }
}
resource "kubernetes_cluster_role" "chronograf" {

  metadata {
    name = "chronograf-role"
  }

  rule {
    api_groups = [""]
    resources  = ["configmaps", "secrets"]
    verbs      = ["get", "watch", "list"]
  }
}

resource "kubernetes_cluster_role_binding" "chronograf" {

  metadata {
    name = "chronograf-role-binding"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = kubernetes_cluster_role.chronograf.metadata.0.name
  }

  subject {
    kind      = "ServiceAccount"
    name      = kubernetes_service_account.chronograf.metadata.0.name
    namespace = kubernetes_namespace.monitoring.metadata.0.name
  }
}

resource "kubernetes_service_account" "chronograf" {

  metadata {
    name      = "chronograf-sa"
    namespace = kubernetes_namespace.monitoring.metadata.0.name
  }

  automount_service_account_token = false
}

resource "kubernetes_config_map" "chronograf" {

  metadata {
    name      = "chronograf-resources"
    namespace = kubernetes_namespace.monitoring.metadata.0.name
  }

  data = merge({
    "default.org"  = file("./resources/chronograf/default.org")
    "internal.src" = file("./resources/chronograf/internal.src")
    "internal.kap" = file("./resources/chronograf/internal.kap")
  }, local.dashboards)
}

resource "kubernetes_deployment" "chronograf" {

  depends_on = [
    kubernetes_stateful_set.influxdb
  ]

  metadata {
    name      = "chronograf"
    namespace = kubernetes_namespace.monitoring.metadata.0.name
  }

  spec {
    selector {
      match_labels = {
        app = "chronograf"
      }
    }
    strategy {
      type = "Recreate"
    }
    template {
      metadata {
        labels = {
          app = "chronograf"
        }
      }
      spec {
        service_account_name            = kubernetes_service_account.chronograf.metadata.0.name
        automount_service_account_token = true
        container {
          name              = "chronograf"
          image             = "chronograf:${local.chronograf_version}"
          image_pull_policy = "IfNotPresent"

          resources {
            requests = {
              memory = "100Mi"
            }
          }

          liveness_probe {
            tcp_socket {
              port = "http"
            }
            initial_delay_seconds = 10
            timeout_seconds       = 5
            period_seconds        = 10
            failure_threshold     = 6
            success_threshold     = 1
          }

          readiness_probe {
            tcp_socket {
              port = "http"
            }
            initial_delay_seconds = 10
            timeout_seconds       = 5
            period_seconds        = 10
            failure_threshold     = 6
            success_threshold     = 1
          }

          security_context {
            run_as_user                = 1000
            run_as_group               = 1000
            allow_privilege_escalation = false
          }

          env {
            name  = "RESOURCES_PATH"
            value = "/usr/share/chronograf/resources"
          }
          port {
            container_port = 8888
            name           = "http"
          }
          volume_mount {
            mount_path = "/var/lib/chronograf"
            name       = "persistent-storage"
          }
          volume_mount {
            mount_path = "/usr/share/chronograf/resources"
            name       = "config"
          }
        }
        volume {
          name = "persistent-storage"
          host_path {
            path = "${local.persistent_folder}/chronograf.data"
          }
        }
        volume {
          name = "config"
          config_map {
            name = kubernetes_config_map.chronograf.metadata.0.name
          }
        }
      }
    }
  }
  lifecycle {
    replace_triggered_by = [
      kubernetes_config_map.chronograf
    ]
  }
}