# Copyright Broadcom, Inc. All Rights Reserved.
# SPDX-License-Identifier: APACHE-2.0

# This application performs modifications at host-level, injecting new configuration files and installing new binaries.
command:
  {{- $uid := .Vars.agent.containerSecurityContext.runAsUser }}
  check-user-info:
    # The UID should always be either the one specified as vars (always a bigger number that the default)
    # or the one randomly defined by openshift (larger values). Otherwise, the chart is still using the default value.
    exec: if [ $(id -u) -lt {{ $uid }} ]; then exit 1; fi
    exit-status: 0
  {{ if .Vars.agent.serviceAccount.automountServiceAccountToken }}
  check-sa:
    exec: cat /var/run/secrets/kubernetes.io/serviceaccount/token | cut -d '.' -f 2 | xargs -I '{}' echo '{}====' | fold -w 4 | sed '$ d' | tr -d '\n' | base64 -d
    exit-status: 0
    stdout:
    - /serviceaccount.*name.*{{ .Env.BITNAMI_APP_NAME }}/
  {{ end }}
http:
  http://127.0.0.1:{{ .Vars.agent.containerPorts.health }}/healthz:
    status: 200
  {{ if .Vars.agent.metrics.enabled }}
  http://127.0.0.1:{{ .Vars.agent.containerPorts.metrics }}/metrics:
    status: 200
  http://cilium-agent-metrics:{{ .Vars.agent.metrics.service.port }}/metrics:
    status: 200
  {{ end }}
  {{ if .Vars.hubble.peers.metrics.enabled }}
  http://127.0.0.1:{{ .Vars.agent.containerPorts.hubbleMetrics }}/metrics:
    status: 200
  http://cilium-hubble-peers-metrics:{{ .Vars.hubble.peers.metrics.service.port }}/metrics:
    status: 200
  {{ end }}
addr:
  tcp://127.0.0.1:{{ .Vars.agent.containerPorts.hubblePeer }}:
    reachable: true
    timeout: 500
  tcp://cilium-hubble-peers:{{ .Vars.hubble.peers.service.port }}:
    reachable: true
    timeout: 500
  {{ if .Vars.agent.enablePprof }}
  tcp://127.0.0.1:{{ .Vars.agent.containerPorts.pprof }}:
    reachable: true
    timeout: 500
  {{ end }}
file:
  # Sockets should be created
  /opt/bitnami/cilium/var/run/cilium.sock:
    exists: true
    filetype: socket
    mode: '0660'
  /opt/bitnami/cilium/var/run/hubble.sock:
    exists: true
    filetype: socket
    mode: '0660'
  {{ if .Vars.hubble.tls.enabled }}
  # Hubble certs are present
  /certs/hubble/ca.crt:
    exists: true
    filetype: symlink
  /certs/hubble/tls.crt:
    exists: true
    filetype: symlink
  /certs/hubble/tls.key:
    exists: true
    filetype: symlink
  {{ end }}
  # Cilium CNI configuration files should be present in the host
  /host/etc/cni/net.d/05-cilium.conflist:
    exists: true
    filetype: file
    mode: '0644'
  # BPF fs should be mounted
  /sys/fs/bpf:
    exists: true
    filetype: directory
