apiVersion: apps/v1
kind: Deployment
metadata:
  name: olm-operator
spec:
  strategy:
    type: RollingUpdate
  replicas: 1
  selector:
    matchLabels:
      app: olm-operator
  template:
    metadata:
      labels:
        app: olm-operator
        hypershift.openshift.io/control-plane-component: olm-operator
    spec:
      volumes:
        - name: srv-cert
          secret:
            secretName: olm-operator-serving-cert
        - name: client-ca
          secret:
            secretName: olm-profile-collector
        - name: kubeconfig
          secret:
            secretName: service-network-admin-kubeconfig
        - name: oas-konnectivity-proxy-cert
          secret:
            secretName: konnectivity-client
      containers:
        - name: olm-operator
          volumeMounts:
            - name: srv-cert
              mountPath: "/srv-cert"
              readOnly: true
            - name: client-ca
              mountPath: "/client-ca"
              readOnly: true
            - mountPath: /etc/openshift/kubeconfig
              name: kubeconfig
              readOnly: true
          command:
            - /bin/olm
          args:
            - --namespace
            - $(OPERATOR_NAMESPACE)
            - --writeStatusName
            - operator-lifecycle-manager
            - --writePackageServerStatusName=""
            - --tls-cert
            - /srv-cert/tls.crt
            - --tls-key
            - /srv-cert/tls.key
            - --client-ca
            - /client-ca/tls.crt
          image: OLM_OPERATOR_IMAGE
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8443
              name: metrics
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8443
              scheme: HTTPS
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8443
              scheme: HTTPS
          terminationMessagePolicy: FallbackToLogsOnError
          env:
            - name: OPERATOR_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: OPERATOR_NAME
              value: olm-operator
            - name: RELEASE_VERSION
              value: RELEASE_VERSION
            - name: KUBECONFIG
              value: /etc/openshift/kubeconfig/kubeconfig
            - name: GRPC_PROXY
              value: socks5://127.0.0.1:8090
            - name: NO_PROXY
              value: kube-apiserver,redhat-operators,certified-operators,community-operators,redhat-marketplace
          resources:
            requests:
              cpu: 10m
              memory: 160Mi
        - name: socks5-proxy
          command:
            - "/usr/bin/konnectivity-socks5-proxy"
          args:
            - run
          image: SOCKS5_PROXY_IMAGE
          env:
            - name: KUBECONFIG
              value: /etc/openshift/kubeconfig/kubeconfig
          ports:
            - containerPort: 8090
          volumeMounts:
            - mountPath: /etc/konnectivity-proxy-tls
              name: oas-konnectivity-proxy-cert
              readOnly: true
            - mountPath: /etc/openshift/kubeconfig
              name: kubeconfig
              readOnly: true
