apiVersion: apps/v1
kind: Deployment
metadata:
  name: iam-policy-controller
spec:
  replicas: 1
  selector:
    matchLabels:
      name: iam-policy-controller
  template:
    metadata:
      labels:
        name: iam-policy-controller
    spec:
      securityContext:
        runAsNonRoot: true
      serviceAccountName: iam-policy-controller
      containers:
        - name: iam-policy-controller
          image: quay.io/stolostron/iam-policy-controller:latest
          command:
            - iam-policy-controller
          args:
            - "--enable-lease=true"
            - "--log-level=2"
            - "--v=0"
          imagePullPolicy: Always
          env:
            - name: WATCH_NAMESPACE
              value: managed
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: "iam-policy-controller"
          securityContext:
            allowPrivilegeEscalation: false
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 10
