---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: security-profiles-operator
  namespace: security-profiles-operator
spec:
  replicas: 3
  selector:
    matchLabels:
      name: security-profiles-operator
  template:
    metadata:
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: runtime/default
      labels:
        name: security-profiles-operator
    spec:
      serviceAccountName: security-profiles-operator
      containers:
        - name: security-profiles-operator
          image: security-profiles-operator
          args:
          - manager
          imagePullPolicy: Always
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
          resources:
            requests:
              memory: 50Mi
              cpu: 250m
            limits:
              memory: 128Mi
          env:
            - name: RELATED_IMAGE_RBAC_PROXY
              value: quay.io/brancz/kube-rbac-proxy:v0.11.0
            - name: RELATED_IMAGE_SELINUXD
              value: quay.io/security-profiles-operator/selinuxd
            - name: OPERATOR_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
      tolerations:
        - key: "node-role.kubernetes.io/master"
          operator: "Exists"
          effect: "NoSchedule"
        - key: "node-role.kubernetes.io/control-plane"
          operator: "Exists"
          effect: "NoSchedule"
        - key: "node.kubernetes.io/not-ready"
          operator: "Exists"
          effect: "NoExecute"
