apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    include.release.openshift.io/ibm-cloud-managed: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
  labels:
    control-plane: controller-manager
  name: special-resource-controller-manager
  namespace: openshift-sro
spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: controller-manager
  template:
    metadata:
      annotations:
        include.release.openshift.io/ibm-cloud-managed: "true"
        include.release.openshift.io/self-managed-high-availability: "true"
        include.release.openshift.io/single-node-developer: "true"
      labels:
        control-plane: controller-manager
    spec:
      containers:
        - args:
            - --secure-listen-address=0.0.0.0:8443
            - --upstream=http://127.0.0.1:8080/
            - --logtostderr=true
            - --v=10
            - --tls-cert-file=/etc/secrets/tls.crt
            - --tls-private-key-file=/etc/secrets/tls.key
            - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
          image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0
          name: kube-rbac-proxy
          ports:
            - containerPort: 8443
              name: https
          volumeMounts:
            - mountPath: /etc/secrets
              name: special-resource-operator-tls
        - args:
            - --metrics-addr=127.0.0.1:8080
            - --enable-leader-election
          command:
            - /manager
          env:
            - name: OPERATOR_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: RELEASE_VERSION
              value: 0.0.1-snapshot
          image: quay.io/openshift-psap/special-resource-operator:conditions
          imagePullPolicy: Always
          name: manager
          resources:
            limits:
              cpu: 200m
              memory: 100Mi
            requests:
              cpu: 200m
              memory: 100Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
      securityContext:
        runAsGroup: 499
        runAsNonRoot: true
        runAsUser: 499
      terminationGracePeriodSeconds: 10
      volumes:
        - name: special-resource-operator-tls
          secret:
            secretName: special-resource-operator-tls
