{{- if .Values.service.enabled }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "mlflow.fullname" . }}-env-secret
  labels:
    app: {{ template "mlflow.name" . }}
    chart: {{ template "mlflow.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
type: Opaque
data:
{{- if and .Values.backendStore.postgres.enabled (not .Values.backendStore.existingDatabaseSecret.name) }}
  PGUSER: {{ required "postgres user must be specified" .Values.backendStore.postgres.user | b64enc }}
  PGPASSWORD: {{ required "postgres password must be specified" .Values.backendStore.postgres.password | b64enc }}
{{- end }}
{{- if .Values.postgresql.enabled }}
  PGUSER: {{ default "postgres" .Values.postgresql.auth.username | b64enc }}
{{- end }}
{{- if and .Values.backendStore.mysql.enabled (not .Values.backendStore.existingDatabaseSecret.name) }}
  MYSQL_USERNAME: {{ required "mysql user must be specified" .Values.backendStore.mysql.user | b64enc }}
  MYSQL_PWD: {{ required "mysql password must be specified" .Values.backendStore.mysql.password | b64enc }}
{{- end }}
{{- if and .Values.backendStore.mssql.enabled (not .Values.backendStore.existingDatabaseSecret.name) }}
  MSSQL_USERNAME: {{ required "mssql user must be specified" .Values.backendStore.mssql.user | b64enc }}
  MSSQL_PWD: {{ required "mssql password must be specified" .Values.backendStore.mssql.password | b64enc }}
{{- end }}
{{- if .Values.mysql.enabled }}
  MYSQL_USERNAME: {{ default "root" .Values.mysql.auth.username | b64enc }}
{{- end }}
{{- if .Values.artifactRoot.azureBlob.enabled }}
{{- if .Values.artifactRoot.azureBlob.connectionString }}
  AZURE_STORAGE_CONNECTION_STRING: {{ .Values.artifactRoot.azureBlob.connectionString | b64enc }}
{{- end }}
{{- if .Values.artifactRoot.azureBlob.accessKey }}
  AZURE_STORAGE_ACCESS_KEY: {{ .Values.artifactRoot.azureBlob.accessKey | b64enc }}
{{- end }}
{{- end }}
{{- if .Values.artifactRoot.s3.enabled }}
{{- if and .Values.artifactRoot.s3.awsAccessKeyId (eq .Values.artifactRoot.s3.existingSecret.name "") (eq .Values.artifactRoot.s3.existingSecret.keyOfAccessKeyId "") }}
  AWS_ACCESS_KEY_ID: {{ .Values.artifactRoot.s3.awsAccessKeyId | b64enc }}
{{- end }}
{{- if and .Values.artifactRoot.s3.awsSecretAccessKey (eq .Values.artifactRoot.s3.existingSecret.name "") (eq .Values.artifactRoot.s3.existingSecret.keyOfSecretAccessKey "") }}
  AWS_SECRET_ACCESS_KEY: {{ .Values.artifactRoot.s3.awsSecretAccessKey | b64enc }}
{{- end }}
{{- end }}
{{- if .Values.ldapAuth.enabled }}
  LDAP_URI: {{ .Values.ldapAuth.uri | b64enc }}
  LDAP_TLS_VERIFY: {{ .Values.ldapAuth.tlsVerification | b64enc }}
  LDAP_LOOKUP_BIND: {{ .Values.ldapAuth.lookupBind | b64enc }}
  LDAP_GROUP_ATTRIBUTE: {{ .Values.ldapAuth.groupAttribute | b64enc }}
  {{- if .Values.ldapAuth.groupAttributeKey }}
  LDAP_GROUP_ATTRIBUTE_KEY: {{ .Values.ldapAuth.groupAttributeKey | b64enc }}
  {{- end }}
  LDAP_GROUP_SEARCH_BASE_DN: {{ .Values.ldapAuth.searchBaseDistinguishedName | b64enc }}
  LDAP_GROUP_SEARCH_FILTER: {{ .Values.ldapAuth.searchFilter | b64enc }}
  LDAP_GROUP_ADMIN_DN: {{ .Values.ldapAuth.adminGroupDistinguishedName | b64enc }}
  LDAP_GROUP_USER_DN: {{ .Values.ldapAuth.userGroupDistinguishedName | b64enc }}
{{- end }}
{{- end }}