{{- range $name, $w := .Values.workloads }}
{{- if and (ne $w.enabled false) (not $w.job) }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $name }}
  labels:
{{- include "big.labels" (dict "root" $ "name" $name) | nindent 4 }}
spec:
  replicas: 1
  # Recreate, not RollingUpdate: single node, ReadWriteOnce volumes, and nothing
  # here is HA — a second pod would just fight the first for the disk.
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ $name }}
      app.kubernetes.io/instance: {{ $.Release.Name }}
  template:
    metadata:
      {{- /*
        A ConfigMap mounted with subPath never picks up updates, so a portal whose
        config.json content changed has to be rolled. Hashing only the values that
        render it keeps the churn off the databases — an emptyDir database that is
        recreated for no reason loses its data (see the runbook §6).
      */}}
      {{- range $w.files }}
      {{- if hasPrefix "portal-config-" .configMap }}
      annotations:
        checksum/portal-config: {{ include "big.keycloakUrl" $ | sha256sum }}
      {{- end }}
      {{- end }}
      labels:
{{- include "big.labels" (dict "root" $ "name" $name) | nindent 8 }}
    spec:
{{- include "big.podspec" (dict "root" $ "name" $name "w" $w) | nindent 6 }}
{{- end }}
{{- end }}