---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: starboard-operator
  namespace: starboard-operator
  labels:
    app: starboard-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      app: starboard-operator
  template:
    metadata:
      labels:
        app: starboard-operator
    spec:
      serviceAccountName: starboard-operator
      automountServiceAccountToken: true
      securityContext:
        runAsNonRoot: true
        runAsUser: 10000
        fsGroup: 10000
      containers:
        - name: operator
          image: docker.io/aquasec/starboard-operator:dev
          imagePullPolicy: IfNotPresent
          securityContext:
            privileged: false
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          env:
            - name: OPERATOR_NAMESPACE
              value: "starboard-operator"
            - name: OPERATOR_TARGET_NAMESPACES
              value: "default"
            - name: OPERATOR_SCANNER_TRIVY_ENABLED
              value: "true"
            - name: OPERATOR_SCANNER_TRIVY_VERSION
              value: "0.11.0"
            - name: OPERATOR_SCANNER_AQUA_CSP_ENABLED
              value: "false"
            - name: OPERATOR_SCANNER_AQUA_CSP_VERSION
              valueFrom:
                secretKeyRef:
                  name: starboard-operator
                  key: OPERATOR_SCANNER_AQUA_CSP_VERSION
                  optional: true
            - name: OPERATOR_SCANNER_AQUA_CSP_HOST
              valueFrom:
                secretKeyRef:
                  name: starboard-operator
                  key: OPERATOR_SCANNER_AQUA_CSP_HOST
                  optional: true
            - name: OPERATOR_SCANNER_AQUA_CSP_USER
              valueFrom:
                secretKeyRef:
                  name: starboard-operator
                  key: OPERATOR_SCANNER_AQUA_CSP_USERNAME
                  optional: true
            - name: OPERATOR_SCANNER_AQUA_CSP_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: starboard-operator
                  key: OPERATOR_SCANNER_AQUA_CSP_PASSWORD
                  optional: true
            - name: OPERATOR_METRICS_BIND_ADDRESS
              value: ":8080"
            - name: OPERATOR_HEALTH_PROBE_BIND_ADDRESS
              value: ":9090"
            - name: OPERATOR_LOG_DEV_MODE
              value: "false"
          ports:
            - name: metrics
              containerPort: 8080
            - name: probes
              containerPort: 9090
          readinessProbe:
            httpGet:
              path: /readyz/
              port: probes
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /healthz/
              port: probes
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 10
