---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: flux-helm-operator
  namespace: flux
spec:
  replicas: 1
  selector:
    matchLabels:
      name: flux-helm-operator
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        name: flux-helm-operator
      annotations:
        prometheus.io/scrape: "true"
    spec:
      serviceAccountName: flux-helm-operator
      volumes:
      #
      # You will need these two volumes if you want to establish validated TLS
      # connections against Tiller
      #
      # - name: helm-tls-ca
      #   configMap:
      #     name: flux-helm-tls-ca-config
      #     defaultMode: 0600
      # Secret type kubernetes.io/tls
      # - name: flux-helm-tls-cert
      #   secret:
      #     secretName: flux-helm-tls-cert
      #     defaultMode: 0400
      #
      # The following volume is for using a customised known_hosts file,
      # which you will need to do if you host your own git repo rather
      # than using github or the like. You'll also need to mount it
      # into the container, below.
      #
      # You may also wish to provide an ssh_config file,
      # mentioning more than one `IdentityFile`; for instance, if you're
      # using more than one GitHub repo. NB the entry key should be
      # "config" rather than "ssh_config" if mounted in ~/.ssh/.
      #
      # - name: sshdir
      #   configMap:
      #     name: flux-ssh-config
      #     defaultMode: 0400

      # SSH key to access the Git repository
        - name: git-key
          secret:
            secretName: flux-git-deploy
            defaultMode: 0400 # when mounted read-only, we won't be able to chmod

      # These two volumes are for mounting a repositories.yaml file,
      # and providing a cache directory. The latter is needed because
      # mounting the former will make the cache/ directory read-only.
      #
      # - name: repositories-yaml
      #   secret:
      #     secretName: flux-helm-repositories
      # - name: repositories-cache
      #   emptyDir: {}

      containers:
      - name: flux-helm-operator
        # There are no ":latest" images for helm-operator. Find the most recent
        # release or image version at https://hub.docker.com/r/weaveworks/helm-operator/tags
        # and replace the tag here.
        image: docker.io/fluxcd/helm-operator:1.0.0-rc8
        imagePullPolicy: IfNotPresent
        ports:
        - name: http
          containerPort: 3030
        livenessProbe:
          httpGet:
            port: 3030
            path: /healthz
          initialDelaySeconds: 1
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            port: 3030
            path: /healthz
          initialDelaySeconds: 1
          timeoutSeconds: 5
        resources:
          requests:
            cpu: 50m
            memory: 64Mi
        volumeMounts:
        # Include this if you need to mount a customised known_hosts or ssh_config
        # file; you'll also need the volume declared above.
        # - name: sshdir
        #   mountPath: /root/.ssh
        #   readOnly: true

          - name: git-key
            mountPath: /etc/fluxd/ssh

        # - name: repositories-yaml
        #   mountPath: /var/fluxd/helm/repository
        # - name: repositories-cache
        #   mountPath: /var/fluxd/helm/repository/cache
        # - name: helm-tls-certs
        #   mountPath: /etc/fluxd/helm
        #   readOnly: true
        # - name: helm-tls-ca
        #   mountPath: /etc/fluxd/helm-ca
        #   readOnly: true
        args:
        # How to find Tiller
        - --tiller-namespace=kube-system
        # Comment out to to establish validated TLS connections against Tiller
        # - --tiller-tls-ca-cert-path=/etc/fluxd/helm-ca/ca.crt
        # - --tiller-tls-enable=true
        # - --tiller-tls-key-path=/etc/fluxd/helm/tls.key
        # - --tiller-tls-cert-path=/etc/fluxd/helm/tls.crt
        # - --tiller-tls-verify=true
        # - --tiller-tls-ca-cert-path=/etc/fluxd/helm-ca/ca.crt

        - --enabled-helm-versions=v3


