apiVersion: apps/v1
kind: Deployment
metadata:
  name: rhm-metric-state
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/name: rhm-metric-state
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/name: rhm-metric-state
  template:
    metadata:
      labels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/name: rhm-metric-state
    spec:
      containers:
        - name: metric-state
          image: metric-state
          imagePullPolicy: IfNotPresent
          resources:
            requests:
              cpu: 100m
              memory: 150Mi
          securityContext: {}
          terminationMessagePolicy: FallbackToLogsOnError
          ports:
            - containerPort: 8080
              name: web
            - containerPort: 8081
              name: metrics
        - image: redhat-marketplace-authcheck:latest
          name: authcheck
          resources:
            requests:
              cpu: 10m
              memory: 20Mi
          terminationMessagePolicy: FallbackToLogsOnError
        - args:
            - --logtostderr
            - --secure-listen-address=:9092
            - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
            - --upstream=http://127.0.0.1:8080/
            - --tls-cert-file=/etc/tls/private/tls.crt
            - --tls-private-key-file=/etc/tls/private/tls.key
            - --upstream-ca-file=/etc/configmaps/serving-cert-ca-bundle/service-ca.crt
          image: registry.redhat.io/openshift4/ose-kube-rbac-proxy:latest
          imagePullPolicy: IfNotPresent
          name: kube-rbac-proxy-1
          ports:
            - containerPort: 9092
              name: https
          resources:
            requests:
              cpu: 10m
              memory: 20Mi
          securityContext: {}
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
            - mountPath: /etc/tls/private
              name: rhm-metric-state-tls
              readOnly: false
            - mountPath: /etc/configmaps/serving-cert-ca-bundle
              name: serving-certs-ca-bundle
              readOnly: false
        - args:
            - --logtostderr
            - --secure-listen-address=:9093
            - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
            - --upstream=http://127.0.0.1:8081/
            - --tls-cert-file=/etc/tls/private/tls.crt
            - --tls-private-key-file=/etc/tls/private/tls.key
            - --upstream-ca-file=/etc/configmaps/serving-certs-ca-bundle/service-ca.crt
          image: registry.redhat.io/openshift4/ose-kube-rbac-proxy:latest
          imagePullPolicy: IfNotPresent
          name: kube-rbac-proxy-2
          ports:
            - containerPort: 9093
              name: https-metrics
          resources:
            requests:
              cpu: 10m
              memory: 20Mi
          securityContext: {}
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
            - mountPath: /etc/tls/private
              name: rhm-metric-state-tls
              readOnly: false
            - mountPath: /etc/configmaps/serving-certs-ca-bundle
              name: serving-certs-ca-bundle
              readOnly: false
      nodeSelector:
        beta.kubernetes.io/os: linux
        node-role.kubernetes.io/master: ''
      priorityClassName: system-cluster-critical
      securityContext: {}
      serviceAccountName: redhat-marketplace-operator
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Exists
      volumes:
        - name: rhm-metric-state-tls
          secret:
            secretName: rhm-metric-state-tls
        - configMap:
            name: serving-certs-ca-bundle
          name: serving-certs-ca-bundle
