apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: authentication-proxy
    app.kubernetes.io/name: token-refresher
    app.kubernetes.io/version: master-2021-02-24-1e01b9c
  name: token-refresher
  namespace: openshift-monitoring
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: authentication-proxy
      app.kubernetes.io/name: token-refresher
  template:
    metadata:
      labels:
        app.kubernetes.io/component: authentication-proxy
        app.kubernetes.io/name: token-refresher
        app.kubernetes.io/version: master-2021-02-24-1e01b9c
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: node-role.kubernetes.io/infra
                operator: Exists
            weight: 1
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/infra
          operator: Exists
      containers:
      - args:
        - --oidc.audience=observatorium-telemeter
        - --oidc.client-id=$(CLIENT_ID)
        - --oidc.client-secret=$(CLIENT_SECRET)
        - --oidc.issuer-url=$(ISSUER_URL)
        - --url=$(RECEIVER_URL)
        env:
        - name: CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: observatorium-credentials
              key: client-id
        - name: CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: observatorium-credentials
              key: client-secret
        - name: RECEIVER_URL
          valueFrom:
            secretKeyRef:
              name: observatorium-credentials
              key: receiver-url
        - name: ISSUER_URL
          value: "https://sso.redhat.com/auth/realms/redhat-external"
        image: quay.io/observatorium/token-refresher:master-2021-02-24-1e01b9c
        name: token-refresher
        ports:
        - containerPort: 8080
          name: http
