---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: azure-msi-operator
  namespace: kube-system
  labels:
    app: azure-msi-operator
spec:
  replicas: 2
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: azure-msi-operator
  template:
    metadata:
      labels:
        app: azure-msi-operator
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '8080'
    spec:
      serviceAccountName: azure-msi-operator
      containers:
        - name: azure-msi-operator
          image: webdevops/azure-msi-operator:latest
          imagePullPolicy: Always
          env:
            #####################################
            # settings
            # verbose output
            - name: VERBOSE
              value: "0"

            # sync interval duration
            - name: SYNC_INTERVAL
              value: "15m"

            # enfoce namespaced AzureIdenity (security feature)
            - name: AZUREIDENTITY_NAMESPACED
              value: "1"

            # enable sync of AzureIdentityBindings to AzureIdentity (based on labels; eg in development environments)
            - name: $AZUREIDENTITY_BINDING_SYNC
              value: "0"

            # overrides namespace detection, can also be hardcoded
            #- name: AZUREIDENTITY_TEMPLATE_NAMESPACE
            #  value: "{{index .Tags "k8snamespace"}}"

            # overrides resourcename creation
            #- name: $AZUREIDENTITY_TEMPLATE_RESOURCENAME
            #  value: "{{ .Name }}-{{ .ClientId }}"

            # limit to this Azure Subscription
            #- name: AZURE_SUBSCRIPTION_ID
            #  value: "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"

            #####################################
            # Azure auth (using AzureAD ServicePrincipal)
            - name: AZURE_TENANT_ID
              valueFrom:
                secretKeyRef:
                  name: azure-msi-operator
                  key: AZURE_TENANT_ID
            - name: AZURE_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: azure-msi-operator
                  key: AZURE_CLIENT_ID
            - name: AZURE_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: azure-msi-operator
                  key: AZURE_CLIENT_SECRET

            #####################################
            # Instance
            - name: INSTANCE_NODENAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: INSTANCE_POD
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: INSTANCE_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          ports:
            - containerPort: 8080
              name: http-metrics
          resources:
            requests:
              memory: "100Mi"
              cpu: "25m"
            limits:
              memory: "100Mi"
              cpu: "500m"
          readinessProbe: &probe
            tcpSocket:
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: http-metrics
            failureThreshold: 1
            periodSeconds: 10
