apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: sbom-operator
  name: sbom-operator
  namespace: default
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: sbom-operator
  template:
    metadata:
      labels:
        app.kubernetes.io/name: sbom-operator
    spec:
      containers:
      - image: ghcr.io/ckotzbauer/sbom-operator:latest
        name: operator
        env:
          - name: SBOM_GIT_ACCESS_TOKEN
            valueFrom:
              secretKeyRef:
                name: "sbom-operator"
                key: "accessToken"
        args:
          # example values
          - --cron="0 6 * * * *"
          - --git-author-email=mybotuser@github.com
          - --git-author-name=mybotuser
          - --git-repository=https://github.com/myorg/my-sbom-repo
          #- --git-path=dev-cluster/sboms
          #- --pod-label-selector=sbom-operator\=true
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        securityContext:
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 101
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
          - mountPath: /work
            name: work
          - mountPath: /tmp
            name: tmp
        resources:
          limits:
            cpu: 500m
            memory: 1Gi
          requests:
            cpu: 100m
            memory: 100Mi
        livenessProbe:
          timeoutSeconds: 3
          httpGet:
            path: "/health"
            port: 8080
        readinessProbe:
          timeoutSeconds: 3
          httpGet:
            path: "/health"
            port: 8080
      volumes:
        - name: work
          emptyDir: {}
        - name: tmp
          emptyDir: {}
      securityContext:
        fsGroup: 101
      serviceAccountName: sbom-operator
