apiVersion: apps/v1
kind: Deployment
metadata:
  name: ibm-cert-manager-operator
  labels:
    app.kubernetes.io/instance: ibm-cert-manager-operator
    app.kubernetes.io/managed-by: ibm-cert-manager-operator
    app.kubernetes.io/name: cert-manager
spec:
  replicas: 1
  selector:
    matchLabels:
      name: ibm-cert-manager-operator
  template:
    metadata:
      labels:
        name: ibm-cert-manager-operator
        app.kubernetes.io/instance: ibm-cert-manager-operator
        app.kubernetes.io/managed-by: ibm-cert-manager-operator
        app.kubernetes.io/name: cert-manager
      annotations:
        productName: IBM Cloud Platform Common Services
        productID: "068a62892a1e4db39641342e592daa25"
        productVersion: "3.4.0"
        productMetric: FREE
    spec:
      serviceAccountName: ibm-cert-manager-operator
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      hostIPC: false
      hostNetwork: false
      hostPID: false
      containers:
        - name: ibm-cert-manager-operator
          image: quay.io/opencloudio/ibm-cert-manager-operator:latest
          command:
          - ibm-cert-manager-operator
          args:
          - --zap-level=1
          imagePullPolicy: Always
          env:
            - name: WATCH_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: "ibm-cert-manager-operator"
            # DO NOT DELETE. Add operand image SHAs here. See common/scripts/get_image_sha_digest.sh and make get-all-operand-image-sha
            - name: CONTROLLER_IMAGE_TAG_OR_SHA
              value: sha256:6e0d55a5f6953dcbdc49bed267c3dd1f58d83f4e086d87c9b268ec5849345424
            - name: WEBHOOK_IMAGE_TAG_OR_SHA
              value: sha256:f0496402de6210cae682bea83fffd2f4526f748b02e7c18fcc0584d046ff1841
            - name: CAINJECTOR_IMAGE_TAG_OR_SHA
              value: sha256:c3fa077f4b884ce44ae9030eba27ee992897c7cc06cdf4ec57c4b6af525b4bb5
            - name: ACMESOLVER_IMAGE_TAG_OR_SHA
              value: sha256:1796bcf5458ecb57f10b84c302321b2a9ddbb32dd1c1364d51c91476eee05b70
            - name: CONFIGMAP_WATCHER_IMAGE_TAG_OR_SHA
              value: sha256:6f6bd9ae19b9f9ed8c013b889931c01a2fab9051b7ffe90161a089045ba3eaa9
          resources:
            limits:
              cpu: 100m
              memory: 300Mi
            requests:
              cpu: 10m
              memory: 50Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: true
