apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: sbom-operator
  name: sbom-operator
  namespace: default
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: sbom-operator
  template:
    metadata:
      labels:
        app.kubernetes.io/name: sbom-operator
    spec:
      containers:
      - image: ghcr.io/ckotzbauer/sbom-operator:latest
        name: operator
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_UID
          valueFrom:
            fieldRef:
              fieldPath: metadata.uid
        # Free account
        - name: SBOM_JOB_CAS_API_KEY
          value: ""
        args:
          # example values
          - --cron="0 6 * * * *"
          - --job-image=ghcr.io/ckotzbauer/sbom-operator/cas:0.10.0
          #- --pod-label-selector=sbom-operator\=true
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        securityContext:
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 101
          seccompProfile:
            type: RuntimeDefault
        resources:
          limits:
            cpu: 500m
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 100Mi
        livenessProbe:
          timeoutSeconds: 3
          httpGet:
            path: "/health"
            port: 8080
        readinessProbe:
          timeoutSeconds: 3
          httpGet:
            path: "/health"
            port: 8080
      securityContext:
        fsGroup: 101
      serviceAccountName: sbom-operator
