kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    app: alibaba-cloud-controller-manager
  name: alibaba-cloud-controller-manager
  namespace: openshift-cloud-controller-manager
spec:
  replicas: 2
  selector:
    matchLabels:
      app: alibaba-cloud-controller-manager
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: alibaba-cloud-controller-manager
    spec:
      hostNetwork: true
      serviceAccountName: cloud-controller-manager
      priorityClassName: system-cluster-critical
      nodeSelector:
        node-role.kubernetes.io/master: ""
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - topologyKey: "kubernetes.io/hostname"
              labelSelector:
                matchLabels:
                  app: alibaba-cloud-controller-manager
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Exists
        - effect: NoExecute
          key: node.kubernetes.io/unreachable
          operator: Exists
          tolerationSeconds: 120
        - effect: NoExecute
          key: node.kubernetes.io/not-ready
          operator: Exists
          tolerationSeconds: 120
        - effect: NoSchedule
          key: node.cloudprovider.kubernetes.io/uninitialized
          operator: Exists
        - effect: NoSchedule
          key: node.kubernetes.io/not-ready
          operator: Exists
      containers:
        - command:
            - /bin/bash
            - -c
            - |
              #!/bin/bash
              set -o allexport
              if [[ -f /etc/kubernetes/apiserver-url.env ]]; then
                source /etc/kubernetes/apiserver-url.env
              fi
              exec /bin/alibaba-cloud-controller-manager \
              --allow-untagged-cloud=true \
              --leader-elect=true \
              --leader-elect-lease-duration=137s \
              --leader-elect-renew-deadline=107s \
              --leader-elect-retry-period=26s \
              --leader-elect-resource-namespace=openshift-cloud-controller-manager \
              --cloud-provider=alicloud \
              --use-service-account-credentials=true \
              --cloud-config=/etc/alibaba/config/cloud-config.conf \
              --feature-gates=ServiceNodeExclusion=true \
              --configure-cloud-routes=false \
              --allocate-node-cidrs=false
          image: quay.io/openshift/origin-alibaba-cloud-controller-manager
          livenessProbe:
            failureThreshold: 8
            httpGet:
              host: 127.0.0.1
              path: /healthz
              port: 10258
              scheme: HTTP
            initialDelaySeconds: 15
            timeoutSeconds: 15
          name: cloud-controller-manager
          ports:
            - containerPort: 10258
              name: https
              protocol: TCP
          resources:
            requests:
              cpu: 200m
              memory: 50Mi
          volumeMounts:
            - mountPath: /etc/kubernetes
              name: host-etc-kube
              readOnly: true
            - name: trusted-ca
              mountPath: /etc/pki/ca-trust/extracted/pem
              readOnly: true
            - name: cloud-config
              mountPath: /etc/alibaba/config
              readOnly: true
      volumes:
        - name: host-etc-kube
          hostPath:
            path: /etc/kubernetes
            type: Directory
        - name: trusted-ca
          configMap:
            name: ccm-trusted-ca
            items:
              - key: ca-bundle.crt
                path: tls-ca-bundle.pem
        - name: cloud-config
          configMap:
            name: cloud-conf
            items:
              - key: cloud.conf
                path: cloud-config.conf
