apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    include.release.openshift.io/ibm-cloud-managed: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
  name: cluster-node-tuning-operator
  namespace: openshift-cluster-node-tuning-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      name: cluster-node-tuning-operator
  template:
    metadata:
      labels:
        name: cluster-node-tuning-operator
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 499
      serviceAccountName: cluster-node-tuning-operator
      nodeSelector:
        node-role.kubernetes.io/master: ""
      priorityClassName: "system-cluster-critical"
      tolerations:
      - key: node-role.kubernetes.io/master  # Just tolerate NoSchedule taint on master node. If there are other conditions like disk-pressure etc, let's not schedule the control-plane pods onto that node.
        operator: Exists
        effect: "NoSchedule"
      - key: "node.kubernetes.io/unreachable"
        operator: "Exists"
        effect: "NoExecute"
        tolerationSeconds: 120 # Evict pods within 2 mins.
      - key: "node.kubernetes.io/not-ready"
        operator: "Exists"
        effect: "NoExecute"
        tolerationSeconds: 120 # Evict pods within 2 mins.
      containers:
        - name: cluster-node-tuning-operator
          image: registry.svc.ci.openshift.org/openshift/origin-v4.0:cluster-node-tuning-operator
          command:
          - cluster-node-tuning-operator
          args:
          - "-v=0"
          env:
          - name: RELEASE_VERSION
            value: "0.0.1-snapshot"
          - name: WATCH_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: RESYNC_PERIOD
            value: "600"
          - name: CLUSTER_NODE_TUNED_IMAGE
            value: registry.svc.ci.openshift.org/openshift/origin-v4.0:cluster-node-tuning-operator
          ports:
          - containerPort: 60000
            name: metrics
          imagePullPolicy: IfNotPresent
          terminationMessagePolicy: FallbackToLogsOnError
          resources:
            requests:
              cpu: 10m
              memory: 20Mi
          volumeMounts:
            # Certificates and keys for node-tuning-operator.openshift-cluster-node-tuning-operator.svc
            - name: node-tuning-operator-tls
              mountPath: /etc/secrets
            - name: trusted-ca
              mountPath: /var/run/configmaps/trusted-ca/
      volumes:
        - name: node-tuning-operator-tls
          secret:
            secretName: node-tuning-operator-tls
        - name: trusted-ca
          configMap:
            name: trusted-ca
            optional: true
            items:
            - key: ca-bundle.crt
              path: tls-ca-bundle.pem
