apiVersion: apps/v1
kind: Deployment
metadata:
  name: cass-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      name: cass-operator
  template:
    metadata:
      labels:
        name: cass-operator
    spec:
      serviceAccountName: cass-operator
      volumes:
        - name: tmpconfig-volume
          emptyDir:
            medium: "Memory"
        - name: cass-operator-certs-volume
          secret:
            secretName: cass-operator-webhook-config
      containers:
        - name: cass-operator
          image: k8ssandra/cass-operator:v1.7.0
          imagePullPolicy: IfNotPresent
          volumeMounts:
            - mountPath: /tmp/k8s-webhook-server/serving-certs
              name: cass-operator-certs-volume
              readOnly: false
            - mountPath: /tmp/
              name: tmpconfig-volume
              readOnly: false

          securityContext:
            runAsUser: 65534
            runAsGroup: 65534
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
          livenessProbe:
            exec:
              command:
                - pgrep
                - ".*operator"
            initialDelaySeconds: 5
            periodSeconds: 5
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            exec:
              command:
                - stat
                - "/tmp/operator-sdk-ready"
            initialDelaySeconds: 5
            periodSeconds: 5
            timeoutSeconds: 5
            failureThreshold: 1
          env:
            - name: WATCH_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: "cass-operator"
            - name: SKIP_VALIDATING_WEBHOOK
              value: "true"