apiVersion: v1
kind: Pod
metadata:
  name: kube-controller-manager
  namespace: openshift-kube-controller-manager
  annotations:
    kubectl.kubernetes.io/default-logs-container: kube-controller-manager
  labels:
    app: kube-controller-manager
    kube-controller-manager: "true"
    revision: "REVISION"
spec:
  containers:
  - name: kube-controller-manager
    image: ${IMAGE}
    imagePullPolicy: IfNotPresent
    terminationMessagePolicy: FallbackToLogsOnError
    command: ["/bin/bash", "-euxo", "pipefail", "-c"]
    args:
        - |
          timeout 3m /bin/bash -exuo pipefail -c 'while [ -n "$(ss -Htanop \( sport = 10257 \))" ]; do sleep 1; done'

          if [ -f /etc/kubernetes/static-pod-certs/configmaps/trusted-ca-bundle/ca-bundle.crt ]; then
            echo "Copying system trust bundle"
            cp -f /etc/kubernetes/static-pod-certs/configmaps/trusted-ca-bundle/ca-bundle.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
          fi

          echo -n "Waiting kube-apiserver to respond."
          tries=0
          until curl --output /dev/null --silent -k https://localhost:6443/version; do
            echo -n "."
            sleep 1
            (( tries += 1 ))
            if [[ "${tries}" -gt 180 ]]; then
              echo "timed out waiting for kube-apiserver to respond."
              exit 1
            fi
          done

          exec hyperkube kube-controller-manager --openshift-config=/etc/kubernetes/static-pod-resources/configmaps/config/config.yaml \
            --kubeconfig=/etc/kubernetes/static-pod-resources/configmaps/controller-manager-kubeconfig/kubeconfig \
            --authentication-kubeconfig=/etc/kubernetes/static-pod-resources/configmaps/controller-manager-kubeconfig/kubeconfig \
            --authorization-kubeconfig=/etc/kubernetes/static-pod-resources/configmaps/controller-manager-kubeconfig/kubeconfig \
            --client-ca-file=/etc/kubernetes/static-pod-certs/configmaps/client-ca/ca-bundle.crt \
            --requestheader-client-ca-file=/etc/kubernetes/static-pod-certs/configmaps/aggregator-client-ca/ca-bundle.crt
    resources:
      requests:
        memory: 200Mi
        cpu: 80m
    ports:
      - containerPort: 10257
    volumeMounts:
    - mountPath: /etc/kubernetes/manifests
      name: manifests-dir # Used in the KubeControllerManagerConfig to pass in recycler pod templates
    - mountPath: /etc/kubernetes/static-pod-resources
      name: resource-dir
    - mountPath: /etc/kubernetes/static-pod-certs
      name: cert-dir
    startupProbe:
      httpGet:
        scheme: HTTPS
        port: 10257
        path: healthz
      initialDelaySeconds: 0
      timeoutSeconds: 3
    livenessProbe:
      httpGet:
        scheme: HTTPS
        port: 10257
        path: healthz
      initialDelaySeconds: 45
      timeoutSeconds: 10
    readinessProbe:
      httpGet:
        scheme: HTTPS
        port: 10257
        path: healthz
      initialDelaySeconds: 10
      timeoutSeconds: 10
  - name: cluster-policy-controller
    image: ${CLUSTER_POLICY_CONTROLLER_IMAGE}
    imagePullPolicy: IfNotPresent
    terminationMessagePolicy: FallbackToLogsOnError
    command: ["/bin/bash", "-euxo", "pipefail", "-c"]
    args:
      - |
        timeout 3m /bin/bash -exuo pipefail -c 'while [ -n "$(ss -Htanop \( sport = 10357 \))" ]; do sleep 1; done'

        echo -n "Waiting kube-apiserver to respond."
        tries=0
        until curl --output /dev/null --silent -k https://localhost:6443/version; do
          echo -n "."
          sleep 1
          (( tries += 1 ))
          if [[ "${tries}" -gt 180 ]]; then
            echo "timed out waiting for kube-apiserver to respond."
            exit 1
          fi
        done
        echo

        exec cluster-policy-controller start --config=/etc/kubernetes/static-pod-resources/configmaps/cluster-policy-controller-config/config.yaml
    resources:
      requests:
        memory: 200Mi
        cpu: 10m
    ports:
      - containerPort: 10357
    volumeMounts:
      - mountPath: /etc/kubernetes/static-pod-resources
        name: resource-dir
      - mountPath: /etc/kubernetes/static-pod-certs
        name: cert-dir
    startupProbe:
      httpGet:
        scheme: HTTPS
        port: 10357
        path: healthz
      initialDelaySeconds: 0
      timeoutSeconds: 3
    livenessProbe:
      httpGet:
        scheme: HTTPS
        port: 10357
        path: healthz
      initialDelaySeconds: 45
      timeoutSeconds: 10
    readinessProbe:
      httpGet:
        scheme: HTTPS
        port: 10357
        path: healthz
      initialDelaySeconds: 10
      timeoutSeconds: 10
  - name: kube-controller-manager-cert-syncer
    env:
      - name: POD_NAME
        valueFrom:
          fieldRef:
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            fieldPath: metadata.namespace
    image: ${OPERATOR_IMAGE}
    imagePullPolicy: IfNotPresent
    terminationMessagePolicy: FallbackToLogsOnError
    command: ["cluster-kube-controller-manager-operator", "cert-syncer"]
    args:
      - --kubeconfig=/etc/kubernetes/static-pod-resources/configmaps/kube-controller-cert-syncer-kubeconfig/kubeconfig
      - --namespace=$(POD_NAMESPACE)
      - --destination-dir=/etc/kubernetes/static-pod-certs
    resources:
      requests:
        memory: 50Mi
        cpu: 5m
    volumeMounts:
      - mountPath: /etc/kubernetes/static-pod-resources
        name: resource-dir
      - mountPath: /etc/kubernetes/static-pod-certs
        name: cert-dir
  - name: kube-controller-manager-recovery-controller
    env:
    - name: POD_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace
    image: ${OPERATOR_IMAGE}
    imagePullPolicy: IfNotPresent
    terminationMessagePolicy: FallbackToLogsOnError
    command: ["/bin/bash", "-euxo", "pipefail", "-c"]
    args:
      - |
        timeout 3m /bin/bash -exuo pipefail -c 'while [ -n "$(ss -Htanop \( sport = 9443 \))" ]; do sleep 1; done'

        exec cluster-kube-controller-manager-operator cert-recovery-controller --kubeconfig=/etc/kubernetes/static-pod-resources/configmaps/kube-controller-cert-syncer-kubeconfig/kubeconfig --namespace=${POD_NAMESPACE} --listen=0.0.0.0:9443 -v=2
    resources:
      requests:
        memory: 50Mi
        cpu: 5m
    volumeMounts:
      - mountPath: /etc/kubernetes/static-pod-resources
        name: resource-dir
      - mountPath: /etc/kubernetes/static-pod-certs
        name: cert-dir
  hostNetwork: true
  priorityClassName: system-node-critical
  tolerations:
  - operator: "Exists"
  volumes:
  - hostPath:
      path: /etc/kubernetes/manifests
    name: manifests-dir
  - hostPath:
      path: /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-REVISION
    name: resource-dir
  - hostPath:
      path: /etc/kubernetes/static-pod-resources/kube-controller-manager-certs
    name: cert-dir
