{{- $fullname := include "vpcatlas.fullname" . -}}
{{- $below := false -}}
{{- if .Values.ingress.enabled -}}
{{- range .Values.ingress.hosts -}}
{{- range .paths -}}
{{- if ne .path "/" -}}{{- $below = true -}}{{- end -}}
{{- end -}}
{{- end -}}
{{- end -}}
VPC Atlas {{ .Chart.AppVersion }}: release "{{ .Release.Name }}", namespace "{{ .Release.Namespace }}".

Reach the dashboard with a port-forward, then open http://127.0.0.1:8080 :

  kubectl port-forward -n {{ .Release.Namespace }} svc/{{ $fullname }} 8080:{{ .Values.service.port }}
{{- if .Values.ingress.enabled }}

The ingress serves it at:
{{- $scheme := ternary "https" "http" (not (empty .Values.ingress.tls)) }}
{{- range .Values.ingress.hosts }}
{{- $host := .host }}
{{- range .paths }}
  {{ $scheme }}://{{ $host }}{{ .path }}
{{- end }}
{{- end }}
{{- end }}
{{- if $below }}

The ingress serves the dashboard below a path. Set config.basePath to the prefix the browser sees
(now: {{ .Values.config.basePath | default "not set" }}) and check one page and one download through it.
{{- end }}
{{- if .Values.auth.enabled }}
{{- if .Values.auth.password }}

HTTP Basic protection is on. The user is "{{ .Values.auth.user }}"; the password is in the Secret
{{ include "vpcatlas.authSecretName" . }}.
{{- else }}

HTTP Basic protection is on and the password comes from an existing Secret. It must exist before
the pod can start, so create it now if you have not:

  kubectl create secret generic {{ .Values.auth.existingSecret.name }} --namespace {{ .Release.Namespace }} \
    --from-literal={{ .Values.auth.existingSecret.key }}='a-long-random-password'

Without it the pod stays in CreateContainerConfigError instead of starting open.
{{- end }}
{{- else }}

WARNING: auth.enabled is false, so the panel is open: anyone who can reach it sees the network
topology of every audited account. Keep it on a private network.
{{- end }}
{{- if and .Values.serviceAccount.create (not .Values.serviceAccount.annotations) }}

The service account has no annotations. On EKS, annotate it with the IAM role of the auditor (IRSA):

  --set 'serviceAccount.annotations.eks\.amazonaws\.com/role-arn=<role-arn>'

Elsewhere, give the pod credentials some other way, for example an existing Secret through extraEnvFrom.
{{- end }}

{{ if gt (int .Values.replicaCount) 1 -}}
You set {{ .Values.replicaCount }} replicas. The snapshot is kept in the memory of each pod,
so each one scans on its own.
{{- else -}}
The chart runs one replica: the snapshot is kept in the memory of the pod, so several replicas would each scan
on their own.
{{- end }}
To keep the history across restarts, enable persistence or set config.snapshotUri to an S3 location.

Check the release with: helm test {{ .Release.Name }} --namespace {{ .Release.Namespace }}
