apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    name: provider-credential-controller
  name: provider-credential-controller
spec:
  replicas: 1
  selector:
    matchLabels:
      name: provider-credential-controller
  template:
    metadata:
      labels:
        name: provider-credential-controller
    spec:
      tolerations:
      - key: dedicated
        operator: Exists
        effect: NoSchedule
      - effect: NoSchedule 
        key: node-role.kubernetes.io/infra 
        operator: Exists
      serviceAccountName: provider-credential-controller
      hostNetwork: false
      hostPID: false
      hostIPC: false
      securityContext:
        runAsNonRoot: true

      containers:
      - command:
        - "./manager"
        - "-enable-leader-election"
        image: registry.ci.openshift.org/open-cluster-management/2.3:provider-credential-controller
        imagePullPolicy: Always
        name: provider-credential-controller
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
        resources:
          limits:
            cpu: "20m"
            memory: "500Mi"
          requests:
            cpu: "3m"
            memory: "65Mi"
      - command:
        - "./old-provider-connection"
        - "-enable-leader-election"
        image: registry.ci.openshift.org/open-cluster-management/2.3:provider-credential-controller
        imagePullPolicy: Always
        name: old-provider-connection
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
        resources:
          limits:
            cpu: "20m"
            memory: "500Mi"
          requests:
            cpu: "3m"
            memory: "65Mi"
