kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: openshift-authentication
  name: oauth-openshift
  labels:
    app: oauth-openshift
spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 0
  selector:
    matchLabels:
      app: oauth-openshift
  template:
    metadata:
      namespace: openshift-authentication
      name: oauth-openshift
      labels:
        app: oauth-openshift
      annotations:
        target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
    spec:
      terminationGracePeriodSeconds: 40
      serviceAccountName: oauth-openshift
      nodeSelector:
        node-role.kubernetes.io/master: ''
      priorityClassName: system-cluster-critical
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: oauth-openshift
                topologyKey: kubernetes.io/hostname
      tolerations:
        - key: node-role.kubernetes.io/master
          operator: Exists
          effect: NoSchedule
        - key: node.kubernetes.io/unreachable
          operator: Exists
          effect: NoExecute
          tolerationSeconds: 120
        - key: node.kubernetes.io/not-ready
          operator: Exists
          effect: NoExecute
          tolerationSeconds: 120
      containers:
        - name: oauth-openshift
          image: ${IMAGE}
          command:
            - /bin/bash
            - '-ec'
          args:
            - |
              if [ -s /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle/ca-bundle.crt ]; then
                  echo "Copying system trust bundle"
                  cp -f /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle/ca-bundle.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
              fi
              exec oauth-server osinserver \
              --config=/var/config/system/configmaps/v4-0-config-system-cliconfig/v4-0-config-system-cliconfig \
              --v=${LOG_LEVEL} \
              ${SERVER_ARGUMENTS}
          ports:
            - name: https
              containerPort: 6443
              protocol: TCP
          securityContext:
            privileged: true
            readOnlyRootFilesystem: false # because of the `cp` in args
            runAsUser: 0 # because /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem is only writable by root
          volumeMounts:
            - mountPath: /var/run/configmaps/audit
              name: audit-policies
            - mountPath: /var/log/oauth-server
              name: audit-dir
            - name: v4-0-config-system-session
              readOnly: true
              mountPath: /var/config/system/secrets/v4-0-config-system-session
            - name: v4-0-config-system-cliconfig
              readOnly: true
              mountPath: /var/config/system/configmaps/v4-0-config-system-cliconfig
            - name: v4-0-config-system-serving-cert
              readOnly: true
              mountPath: /var/config/system/secrets/v4-0-config-system-serving-cert
            - name: v4-0-config-system-service-ca
              readOnly: true
              mountPath: /var/config/system/configmaps/v4-0-config-system-service-ca
            - name: v4-0-config-system-router-certs
              readOnly: true
              mountPath: /var/config/system/secrets/v4-0-config-system-router-certs
            - name: v4-0-config-system-ocp-branding-template
              readOnly: true
              mountPath: /var/config/system/secrets/v4-0-config-system-ocp-branding-template
            - name: v4-0-config-user-template-login
              readOnly: true
              mountPath: /var/config/user/template/secret/v4-0-config-user-template-login
            - name: v4-0-config-user-template-provider-selection
              readOnly: true
              mountPath: /var/config/user/template/secret/v4-0-config-user-template-provider-selection
            - name: v4-0-config-user-template-error
              readOnly: true
              mountPath: /var/config/user/template/secret/v4-0-config-user-template-error
            - name: v4-0-config-system-trusted-ca-bundle
              readOnly: true
              mountPath: /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle
          readinessProbe:
            httpGet:
              path: /healthz
              port: 6443
              scheme: HTTPS
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /healthz
              port: 6443
              scheme: HTTPS
            initialDelaySeconds: 30
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          lifecycle:
            # delay shutdown by 25s to ensure existing connections are drained
            # * 5s for endpoint propagation on delete
            # * 5s for route reload
            # * 15s for the longest running request to finish
            preStop:
              exec:
                command:
                - sleep
                - "25"
          terminationMessagePolicy: FallbackToLogsOnError
          resources:
            requests:
              cpu: 10m
              memory: 50Mi
      volumes:
        - name: audit-policies
          configMap:
            name: audit
        - hostPath:
            path: /var/log/oauth-server
          name: audit-dir
        - name: v4-0-config-system-session
          secret:
            secretName: v4-0-config-system-session
        - name: v4-0-config-system-cliconfig
          configMap:
            name: v4-0-config-system-cliconfig
        - name: v4-0-config-system-serving-cert
          secret:
            secretName: v4-0-config-system-serving-cert
        - name: v4-0-config-system-service-ca
          configMap:
            name: v4-0-config-system-service-ca
        - name: v4-0-config-system-router-certs
          secret:
            secretName: v4-0-config-system-router-certs
        - name: v4-0-config-system-ocp-branding-template
          secret:
            secretName: v4-0-config-system-ocp-branding-template
        - name: v4-0-config-user-template-login
          secret:
            secretName: v4-0-config-user-template-login
            optional: true
        - name: v4-0-config-user-template-provider-selection
          secret:
            secretName: v4-0-config-user-template-provider-selection
            optional: true
        - name: v4-0-config-user-template-error
          secret:
            secretName: v4-0-config-user-template-error
            optional: true
        - name: v4-0-config-system-trusted-ca-bundle
          configMap:
            name: v4-0-config-system-trusted-ca-bundle
            optional: true
