# Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: gatekeeper-securitycenter-controller-manager
  namespace: gatekeeper-securitycenter # kpt-set: ${namespace}
  labels:
    control-plane: controller-manager
    gatekeeper-securitycenter/operation: manager
    gatekeeper-securitycenter/system: 'yes'
spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: controller-manager
      gatekeeper-securitycenter/operation: controller
      gatekeeper-securitycenter/system: 'yes'
  template:
    metadata:
      labels:
        control-plane: controller-manager
        gatekeeper-securitycenter/operation: controller
        gatekeeper-securitycenter/system: 'yes'
      annotations:
        container.seccomp.security.alpha.kubernetes.io/manager: runtime/default
    spec:
      serviceAccountName: gatekeeper-securitycenter-controller
      containers:
      - name: manager
        image: ko://github.com/googlecloudplatform/gatekeeper-securitycenter # kpt-set: ${image}
        args:
        - findings
        - manager
        - --source=$(SOURCE)
        - --cluster=$(CLUSTER)
        - --interval=120 # kpt-set: --interval=${interval}
        - --dry-run=false # kpt-set: --dry-run=${dry-run}
        env:
        - name: SOURCE
          valueFrom:
            configMapKeyRef:
              name: gatekeeper-securitycenter-config
              key: SOURCE_NAME
        - name: CLUSTER
          valueFrom:
            configMapKeyRef:
              name: gatekeeper-securitycenter-config
              key: CLUSTER_NAME
        - name: DEBUG
          value: "false" # kpt-set: ${debug-env}
        resources:
          requests:
            cpu: 250m # kpt-set: ${request-cpu}
            memory: 512Mi # kpt-set: ${request-memory}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - all
          readOnlyRootFilesystem: true
          runAsGroup: 65532
          runAsNonRoot: true
          runAsUser: 65532
