apiVersion: apps/v1
kind: Deployment
metadata:
  name: kibana
  namespace: {{ include "cloudhost-logging.namespace" . }}
  labels:
    app: kibana
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kibana
  template:
    metadata:
      labels:
        app: kibana
    spec:
      initContainers:
        - name: setup-kibana-system-user
          image: {{ .Values.images.curl | default "curlimages/curl:8.5.0" }}
          env:
            - name: ELASTIC_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: elasticsearch-credentials
                  key: ELASTIC_PASSWORD
            - name: KIBANA_SYSTEM_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: elasticsearch-credentials
                  key: KIBANA_SYSTEM_PASSWORD
          command:
            - sh
            - -ec
            - |
              echo "Waiting for Elasticsearch..."
              until curl -sf -u "elastic:${ELASTIC_PASSWORD}" \
                "http://elasticsearch:9200/_cluster/health?wait_for_status=yellow&timeout=60s"; do
                sleep 5
              done
              echo "Setting kibana_system password..."
              HTTP_CODE=$(curl -s -o /tmp/curl-out -w "%{http_code}" -X POST \
                -u "elastic:${ELASTIC_PASSWORD}" \
                "http://elasticsearch:9200/_security/user/kibana_system/_password" \
                -H "Content-Type: application/json" \
                -d "{\"password\":\"${KIBANA_SYSTEM_PASSWORD}\"}")
              if [ "$HTTP_CODE" != "200" ] && [ "$HTTP_CODE" != "201" ]; then
                echo "kibana_system password setup failed (HTTP $HTTP_CODE):"
                cat /tmp/curl-out
                exit 1
              fi
              echo "kibana_system user ready"
              echo "Configuring single-node index settings..."
              curl -sf -X PUT -u "elastic:${ELASTIC_PASSWORD}" \
                "http://elasticsearch:9200/_index_template/single-node-zero-replicas" \
                -H "Content-Type: application/json" \
                -d '{"index_patterns":["*"],"priority":1,"template":{"settings":{"index.number_of_replicas":0}}}'
              curl -sf -X PUT -u "elastic:${ELASTIC_PASSWORD}" \
                "http://elasticsearch:9200/.kibana*/_settings" \
                -H "Content-Type: application/json" \
                -d '{"index":{"number_of_replicas":0}}' || true
      containers:
        - name: kibana
          image: {{ .Values.images.kibana }}
          ports:
            - containerPort: 5601
          env:
            - name: ELASTICSEARCH_HOSTS
              value: http://elasticsearch:9200
            - name: ELASTICSEARCH_USERNAME
              value: kibana_system
            - name: ELASTICSEARCH_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: elasticsearch-credentials
                  key: KIBANA_SYSTEM_PASSWORD
            - name: SERVER_NAME
              value: kibana
            - name: XPACK_SECURITY_ENABLED
              value: "true"
          resources:
            {{- toYaml .Values.kibana.resources | nindent 12 }}
          readinessProbe:
            httpGet:
              path: /api/status
              port: 5601
            initialDelaySeconds: 45
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet:
              path: /api/status
              port: 5601
            initialDelaySeconds: 90
            periodSeconds: 30
            timeoutSeconds: 5