apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: operator
    app.kubernetes.io/name: instana
    app.kubernetes.io/version: 221-1
  name: instana-operator
  namespace: instana-operator
  annotations:
    argocd.argoproj.io/sync-wave: "210"
    helm.sh/hook-weight: "210"
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: operator
      app.kubernetes.io/name: instana
  template:
    metadata:
      labels:
        app.kubernetes.io/component: operator
        app.kubernetes.io/name: instana
        app.kubernetes.io/version: 221-1
    spec:
      imagePullSecrets:
        - name: instana-pullsecret
      containers:
        - env:
            - name: WATCH_NAMESPACE
              value: ""
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
          image: containers.instana.io/instana/release/selfhosted/operator:221-1
          imagePullPolicy: IfNotPresent
          name: instana-operator
          ports:
            - containerPort: 9443
              name: https-webhook
              protocol: TCP
            - containerPort: 8081
              name: http-readyz
              protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /readyz
              port: http-readyz
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources: {}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
          volumeMounts:
            - mountPath: /tmp
              name: tmpdir
            - mountPath: /etc/websocket/certs
              name: cert
              readOnly: true
      serviceAccountName: instana-operator
      volumes:
        - emptyDir: {}
          name: tmpdir
        - name: cert
          secret:
            defaultMode: 420
            secretName: instana-operator-webhook-certs
