apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: kube-prometheus-stack-operator
    app.kubernetes.io/instance: RELEASE-NAME
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: kube-prometheus-stack
    app.kubernetes.io/version: 30.2.0
    chart: kube-prometheus-stack-30.2.0
    heritage: Helm
    release: RELEASE-NAME
  name: RELEASE-NAME-kube-promethe-operator
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kube-prometheus-stack-operator
      release: RELEASE-NAME
  template:
    metadata:
      labels:
        app: kube-prometheus-stack-operator
        app.kubernetes.io/instance: RELEASE-NAME
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/part-of: kube-prometheus-stack
        app.kubernetes.io/version: 30.2.0
        chart: kube-prometheus-stack-30.2.0
        heritage: Helm
        release: RELEASE-NAME
    spec:
      containers:
      - args:
        - --kubelet-service=kube-system/RELEASE-NAME-kube-promethe-kubelet
        - --localhost=127.0.0.1
        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.53.1
        - --config-reloader-cpu-request=100m
        - --config-reloader-cpu-limit=100m
        - --config-reloader-memory-request=50Mi
        - --config-reloader-memory-limit=50Mi
        - --thanos-default-base-image=quay.io/thanos/thanos:v0.24.0
        - --web.enable-tls=true
        - --web.cert-file=/cert/cert
        - --web.key-file=/cert/key
        - --web.listen-address=:10250
        - --web.tls-min-version=VersionTLS13
        image: quay.io/prometheus-operator/prometheus-operator:v0.53.1
        imagePullPolicy: IfNotPresent
        name: kube-prometheus-stack
        ports:
        - containerPort: 10250
          name: https
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /cert
          name: tls-secret
          readOnly: true
      securityContext:
        fsGroup: 65534
        runAsGroup: 65534
        runAsNonRoot: true
        runAsUser: 65534
      serviceAccountName: RELEASE-NAME-kube-promethe-operator
      volumes:
      - name: tls-secret
        secret:
          defaultMode: 420
          secretName: RELEASE-NAME-kube-promethe-admission
