{{/* Print release information */}}
{{- printf "\n\n" -}}
{{ .Release.Name }} with {{ include "traefik.image-name" . }} has been deployed successfully on {{ template "traefik.namespace" . }} namespace!
{{- printf "\n" -}}


{{/* Warn about non-standard versions (experimental, or pre-release outside supported range) */}}
{{- $imageTag := (.Values.image.tag | default (include "traefik.defaultTag" .)) -}}
{{- $version := include "traefik.proxyVersion" $ -}}
{{- $proxyMaxVersion := index .Chart.Annotations "traefik.io/proxy-max-version" -}}
{{- if or (hasPrefix "experimental-" $imageTag) (eq (include "traefik.isAboveMaxVersion" (dict "version" $version "max" $proxyMaxVersion)) "true") -}}
{{- printf "\n" -}}
{{ include "traefik.nonStandardVersionWarning" (dict "label" "image tag" "tag" $imageTag) }}
{{- printf "\n" -}}
{{- end -}}


{{/* Deprecation: inline literal hub.token in values (chart creates the license Secret). */}}
{{- if ge (len (.Values.hub.token | default "")) 65 -}}
{{- printf "\n" -}}
⚠️ DEPRECATION: providing the Traefik Hub license token inline in values is deprecated and will
be removed in a future release. A token in `values.yaml` is a sensitive value that leaks into
release state, version control and CI logs. Instead, create a `Secret` yourself (with a 'token'
key) and set `hub.token` to that Secret's name. ⚠️
{{- printf "\n" -}}
{{- end -}}


{{/* Inform about Traefik Hub running in proxy mode */}}
{{- if and (eq (include "traefik.hub.enabled" .) "true") (not .Values.hub.token) -}}
{{- printf "\n" -}}
ℹ️ Traefik Hub is running in proxy mode: it behaves as a Traefik Proxy and no commercial
feature is enabled. Set `hub.token` to a Secret containing your license to enable API Gateway,
without changing the image. ℹ️
{{- printf "\n" -}}
{{- end -}}


{{/* Warn about non-standard Traefik Hub versions (pre-release or minor/patch above supported range) */}}
{{- if eq (include "traefik.hub.enabled" .) "true" -}}
{{- $hubVersion := include "traefik.hubVersion" $ -}}
{{- $hubMaxVersion := index .Chart.Annotations "traefik.io/hub-max-version" -}}
{{- if and (regexMatch "v[0-9]+.[0-9]+.[0-9]+" $hubVersion) (eq (include "traefik.isAboveMaxVersion" (dict "version" $hubVersion "max" $hubMaxVersion)) "true") -}}
{{- printf "\n" -}}
{{ include "traefik.nonStandardVersionWarning" (dict "label" "Traefik Hub image tag" "tag" $hubVersion) }}
{{- printf "\n" -}}
{{- end -}}
{{- end -}}


{{/* Warn about missing pull credentials for the hardened image (SA-attached secrets are not visible here) */}}
{{- if and .Values.hub.hardened (empty .Values.deployment.imagePullSecrets) -}}
{{- printf "\n" -}}
🚨 hardened images are hosted on a private registry: pulling {{ include "traefik.image-name" . }} needs
credentials, from `deployment.imagePullSecrets` or from the ServiceAccount used by Traefik. 🚨
{{- printf "\n" -}}
{{- end -}}


{{/* Warn about potential permission issue with persistence */}}
{{- if .Values.persistence -}}
  {{- if and .Values.persistence.enabled (empty .Values.deployment.initContainers) -}}
{{- printf "\n" -}}
🚨 When enabling persistence for certificates, permissions on acme.json can be
lost when Traefik restarts. You can ensure correct permissions with an
initContainer. See https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md#use-traefik-native-lets-encrypt-integration-without-cert-manager
for more info. 🚨
{{- printf "\n" -}}
  {{- end -}}
{{- end -}}


{{/* Warn about non-matching potential labelSelector mismatch for CRD provider */}}
{{- with .Values.providers.kubernetesCRD.labelSelector -}}
  {{- $labelsApplied := include "traefik.labels" $ -}}
  {{- $labelSelectors := regexSplit "," . -1 }}
  {{- range $labelSelectors -}}
    {{- $labelSelectorRaw := regexSplit "=" . -1 -}}
    {{- $labelSelector := printf "%s: %s" (first $labelSelectorRaw) (last $labelSelectorRaw) -}}
    {{- if not (contains $labelSelector $labelsApplied) -}}
{{- printf "\n" -}}
🚨 Resources populated with this chart don't match with labelSelector `{{.}}` applied on kubernetesCRD provider. 🚨
{{- printf "\n" -}}
    {{- end -}}
  {{- end -}}
{{- end -}}


{{/* Warn about non-matching potential labelSelector mismatch for Ingress provider */}}
{{- with .Values.providers.kubernetesIngress.labelSelector -}}
  {{- $labelsApplied := include "traefik.labels" $ -}}
  {{- $labelSelectors := regexSplit "," . -1 -}}
  {{- range $labelSelectors -}}
    {{- $labelSelectorRaw := regexSplit "=" . -1 -}}
    {{- $labelSelector := printf "%s: %s" (first $labelSelectorRaw) (last $labelSelectorRaw) -}}
    {{- if not (contains $labelSelector $labelsApplied) -}}
{{- printf "\n" -}}
🚨 Resources populated with this chart don't match with labelSelector `{{.}}` applied on kubernetesIngress provider. 🚨
{{- printf "\n" -}}
    {{- end -}}
  {{- end -}}
{{- end -}}


{{/* Warn about renamed ports */}}
{{- range $name, $config := .Values.ports -}}
  {{- $sanitizedPortName := include "traefik.portname" $name -}}
  {{- if (ne $sanitizedPortName $name) -}}
{{- printf "\n" -}}
🚨 Port name `{{ $name }}` does not comply with Kubernetes standards and will be renamed to `{{ $sanitizedPortName }}` in services. 🚨
ℹ️ See the "traefik.portname" helper in this chart for additional details. ℹ️
{{- printf "\n" -}}
  {{- end -}}
{{- end -}}


{{/* Warn about hub not watching namespaces configured in providers */}}
{{- if and .Values.hub.token (and .Values.rbac.enabled .Values.rbac.namespaced) }}
    {{- if .Values.hub.namespaces -}}
        {{- range (list "kubernetesCRD" "kubernetesGateway" "kubernetesIngress") }}
            {{- $provider := . -}}
            {{- $providerNamespaces := get (get $.Values.providers .) "namespaces" -}}
            {{- $providerEnabled := get (get $.Values.providers .) "enabled" -}}
            {{- if $providerEnabled -}}
                {{- if $providerNamespaces -}}
                    {{- $difference := (include "list.difference" (dict "a" $providerNamespaces "b" $.Values.hub.namespaces)) | fromYamlArray }}
                    {{- if $difference }}
                        {{- printf "WARNING: %s provider is configured to watch namespaces %s but those ones are not watched by Hub provider.\n" $provider $difference -}}
                    {{- end -}}
                {{- else -}}
                    {{- printf "WARNING: %s provider is configured to watch all namespaces but Hub provider only watches %s.\n" $provider $.Values.hub.namespaces -}}
                {{- end -}}
            {{- end -}}
        {{- end -}}
    {{- end -}}
{{- end -}}

{{/* Warn about deprecated localPlugins */}}
  {{- if include "traefik.hasDeprecatedLocalPlugins" . }}
    {{- printf "\n" -}}
⚠️ DEPRECATION WARNING: You are using the deprecated legacy 'hostPath' configuration.
Please migrate to the new structured 'type.hostPathPlugin' configuration within localPlugins.
The legacy root-level hostPath configuration will be removed in the next major version.

Migration example:
  experimental:
    localPlugins:
      your-plugin:
        moduleName: github.com/example/yourplugin
        mountPath: /plugins-local/src/github.com/example/yourplugin
        # Choose one of the following types:
        type: inlinePlugin        # Recommended for small/medium plugins: secure ConfigMap-based
        source:                  # Required for inlinePlugin
          # your plugin files here
        # type: hostPath         # Use with caution for security reasons
        #   hostPath: /path/to/plugin
        # type: localPath       # Advanced: Uses additionalVolumes, can be used with PVC, CSI drivers (s3-csi-driver, FUSE), etc.
        #   volumeName: plugin-storage
    {{- printf "\n" -}}
  {{- end -}}


{{/* Warn about Gateway API CRDs no longer shipped with this chart in future versions */}}
{{- if .Values.providers.kubernetesGateway.enabled }}
{{- printf "\n" -}}
⚠️ DEPRECATION WARNING: Gateway API CRDs will no longer be shipped with this chart in a future major version.
You will need to install them yourself before deploying Traefik v3.7:
  kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.1/standard-install.yaml
{{- printf "\n" -}}
{{- end -}}


{{/* Warn about missing secret when enabling managed certificate with Hub admission controller */}}
{{- if and .Values.hub.token .Values.hub.apimanagement.enabled .Values.hub.apimanagement.admission.selfManagedCertificate }}
  {{- $cert := lookup "v1" "Secret" (include "traefik.namespace" .) $.Values.hub.apimanagement.admission.secretName -}}
  {{- if not $cert }}
    {{- printf "\nWARNING: webhook secret %s for Traefik hub is self managed and was not found in %s namespace.\n" $.Values.hub.apimanagement.admission.secretName (include "traefik.namespace" .) -}}
  {{- end -}}        
{{- end -}}
