apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: security
    istio: citadel
  name: istio-citadel
spec:
  replicas: 1
  selector:
    matchLabels:
      istio: citadel
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: security
        istio: citadel
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - ppc64le
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - s390x
            weight: 2
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      containers:
      - args:
        - --sds-enabled=true
        - --append-dns-names=true
        - --grpc-port=8060
        - --citadel-storage-namespace=istio-system
        - --custom-dns-names=istio-pilot-service-account.istio-system:istio-pilot.istio-system
        - --monitoring-port=15014
        - --self-signed-ca=true
        - --workload-cert-ttl=2160h
        env:
        - name: CITADEL_ENABLE_NAMESPACES_BY_DEFAULT
          value: "true"
        image: gcr.io/istio-release/citadel:release-1.3-latest-daily
        imagePullPolicy: IfNotPresent
        name: citadel
        resources:
          requests:
            cpu: 10m
      serviceAccountName: istio-citadel-service-account
