# This patch inject a sidecar container which is a HTTP proxy for the controller manager,
# it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cluster-baremetal-operator
  namespace: openshift-machine-api
  labels:
    k8s-app: cluster-baremetal-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: cluster-baremetal-operator
  template:
    metadata:
      labels:
        k8s-app: cluster-baremetal-operator
    spec:
      containers:
      - name: kube-rbac-proxy
        image: registry.svc.ci.openshift.org/openshift:kube-rbac-proxy
        args:
        - "--secure-listen-address=0.0.0.0:8443"
        - "--upstream=http://localhost:8080/"
        - "--tls-cert-file=/etc/tls/private/tls.crt"
        - "--tls-private-key-file=/etc/tls/private/tls.key"
        - "--config-file=/etc/kube-rbac-proxy/config-file.yaml"
        - "--logtostderr=true"
        - "--v=10"
        ports:
        - name: https
          containerPort: 8443
          protocol: TCP
        resources:
          requests:
            memory: 20Mi
            cpu: 10m
        volumeMounts:
        - name: config
          mountPath: /etc/kube-rbac-proxy
        - name: cluster-baremetal-operator-tls
          mountPath: /etc/tls/private
      volumes:
        - name: config
          configMap:
            name: kube-rbac-proxy
            defaultMode: 420
        - name: cluster-baremetal-operator-tls
          secret:
            secretName: cluster-baremetal-operator-tls
            defaultMode: 420
