---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cluster-image-registry-operator
  namespace: openshift-image-registry
  annotations:
    config.openshift.io/inject-proxy: cluster-image-registry-operator
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
spec:
  replicas: 1
  selector:
    matchLabels:
      name: cluster-image-registry-operator
  template:
    metadata:
      annotations:
        target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
      labels:
        name: cluster-image-registry-operator
    spec:
      serviceAccountName: cluster-image-registry-operator
      shareProcessNamespace: false
      priorityClassName: system-cluster-critical
      nodeSelector:
        node-role.kubernetes.io/master: ""
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
        operator: Exists
      - key: "node.kubernetes.io/unreachable"
        operator: "Exists"
        effect: "NoExecute"
        tolerationSeconds: 120
      - key: "node.kubernetes.io/not-ready"
        operator: "Exists"
        effect: "NoExecute"
        tolerationSeconds: 120
      containers:
        - name: cluster-image-registry-operator
          args:
          - --files=/var/run/configmaps/trusted-ca/tls-ca-bundle.pem
          - --files=/etc/secrets/tls.crt
          - --files=/etc/secrets/tls.key
          image: docker.io/openshift/origin-cluster-image-registry-operator:latest
          ports:
          - containerPort: 60000
            name: metrics
          imagePullPolicy: IfNotPresent
          resources:
            requests:
              cpu: 10m
              memory: 50Mi
          env:
            - name: RELEASE_VERSION
              value: "0.0.1-snapshot"
            - name: WATCH_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: OPERATOR_NAME
              value: "cluster-image-registry-operator"
            - name: IMAGE
              value: docker.io/openshift/origin-docker-registry:latest
            - name: IMAGE_PRUNER
              value: quay.io/openshift/origin-cli:v4.0
          volumeMounts:
            - name: trusted-ca
              mountPath: /var/run/configmaps/trusted-ca/
            - name: image-registry-operator-tls
              mountPath: /etc/secrets
            - name: bound-sa-token
              mountPath: /var/run/secrets/openshift/serviceaccount
              readOnly: true
      volumes:
        - name: image-registry-operator-tls
          secret:
            secretName: image-registry-operator-tls
        - name: trusted-ca
          configMap:
            name: trusted-ca
            optional: true
            items:
            - key: ca-bundle.crt
              path: tls-ca-bundle.pem
        # This service account token can be used to provide identity outside the cluster.
        # For example, this token can be used with AssumeRoleWithWebIdentity to authenticate
        # with AWS using an IAM OIDC provider and STS.
        - name: bound-sa-token
          projected:
            sources:
            - serviceAccountToken:
                path: token
                audience: openshift
