{{- if .Values.liteadmin.enabled }}
{{- $name := printf "%s-liteadmin" (include "litellm.fullname" . | trunc 53 | trimSuffix "-") }}
{{- $secret := required "liteadmin.existingSecret is required" .Values.liteadmin.existingSecret }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $name }}
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ $name }}
      app.kubernetes.io/instance: {{ .Release.Name }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ $name }}
        app.kubernetes.io/instance: {{ .Release.Name }}
    spec:
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 75
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      securityContext:
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
        runAsNonRoot: true
      containers:
        - name: liteadmin
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          args: ["--admin-agent"]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ALL]
          envFrom:
            - secretRef:
                name: {{ $secret }}
          env:
            - name: CONNECTION_AUTH_MODE
              value: native
            - name: LITELLM_BASE_URL
              value: {{ required "liteadmin.gatewayUrl is required" .Values.liteadmin.gatewayUrl | quote }}
            - name: LITELLM_MODEL
              value: {{ required "liteadmin.model is required" .Values.liteadmin.model | quote }}
            - name: STATE_DB
              value: /var/data/events.sqlite3
            - name: ADMIN_READ_ONLY
              value: {{ .Values.liteadmin.readOnly | quote }}
            - name: OPENAI_AGENTS_DISABLE_TRACING
              value: "1"
          ports:
            - name: health
              containerPort: 10000
          readinessProbe:
            httpGet:
              path: /readyz
              port: health
            periodSeconds: 15
          livenessProbe:
            httpGet:
              path: /healthz
              port: health
            periodSeconds: 30
          resources:
            {{- toYaml .Values.liteadmin.resources | nindent 12 }}
          volumeMounts:
            - name: state
              mountPath: /var/data
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: state
          persistentVolumeClaim:
            claimName: {{ $name }}
        - name: tmp
          emptyDir:
            sizeLimit: 64Mi
---
apiVersion: v1
kind: Service
metadata:
  name: {{ $name }}
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: {{ $name }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  ports:
    - port: 10000
      targetPort: health
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ $name }}
spec:
  accessModes: [ReadWriteOnce]
  {{- with .Values.liteadmin.storageClassName }}
  storageClassName: {{ . | quote }}
  {{- end }}
  resources:
    requests:
      storage: {{ .Values.liteadmin.storageSize }}
{{- end }}