##################################################################################
#                                DO NOT EDIT
# File generated during execution of: generate-release-controllers.py
##################################################################################


#---------------------------------------------------------------------------------
# signer_resources.py added the following resource
#---------------------------------------------------------------------------------

# The signer watches all release tags and signs those that have the correct metadata and images are reachable (according
# to an `oc adm release info --verify` invocation). Signatures a test that the specified release image was built within the
# CI infrastructure or tagged in by a privileged user. Future versions of the verifier may add additional constraints.
# The signer will sign both OKD, CI, and nightly releases, but nightly releases do not trust the CI signer.
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    image.openshift.io/triggers: '[{"from":{"kind":"ImageStreamTag","name":"release-controller:latest"},"fieldPath":"spec.template.spec.containers[?(@.name==\"controller\")].image"}]'
  name: release-controller-signer
  namespace: ci
spec:
  replicas: 1
  selector:
    matchLabels:
      app: release-controller-signer
  template:
    metadata:
      labels:
        app: release-controller-signer
    spec:
      containers:
      - command:
        - /usr/bin/release-controller
        - --release-namespace=ocp
        - --release-namespace=origin
        - --job-namespace=ci-release
        - --non-prow-job-kubeconfig=/etc/kubeconfig/kubeconfig
        - --tools-image-stream-tag=4.6:tests
        - --audit=gs://openshift-ci-release/releases
        - --sign=/etc/release-controller/signer/openshift-ci.gpg
        - --audit-gcs-service-account=/etc/release-controller/publisher/service-account.json
        - -v=4
        image: release-controller:latest
        name: controller
        volumeMounts:
        - mountPath: /etc/release-controller/publisher
          name: publisher
          readOnly: true
        - mountPath: /etc/kubeconfig
          name: release-controller-kubeconfigs
          readOnly: true
        - mountPath: /etc/release-controller/signer
          name: signer
          readOnly: true
      serviceAccountName: release-controller
      volumes:
      - name: publisher
        secret:
          secretName: release-controller-signature-publisher
      - name: release-controller-kubeconfigs
        secret:
          items:
          - key: sa.release-controller-ocp.app.ci.config
            path: kubeconfig
          secretName: release-controller-kubeconfigs
      - name: signer
        secret:
          secretName: release-controller-signature-signer
