# Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https:#www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License. 

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: gmp-system
  name: gmp-operator
  labels:
    app: managed-prometheus-operator
    app.kubernetes.io/name: gmp-operator
    app.kubernetes.io/component: operator
    app.kubernetes.io/part-of: gmp
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: gmp-operator
      app.kubernetes.io/component: operator
      app.kubernetes.io/part-of: gmp
  template:
    metadata:
      labels:
        app: managed-prometheus-operator
        app.kubernetes.io/name: gmp-operator
        app.kubernetes.io/component: operator
        app.kubernetes.io/part-of: gmp
    spec:
      serviceAccountName: operator
      containers:
      - name: operator
        image: gke.gcr.io/prometheus-engine/operator:v0.3.3-gke.0
        args:
        - "--public-namespace=gmp-public"
        - "--priority-class=gmp-critical"
        - "--image-collector=gke.gcr.io/prometheus-engine/prometheus:v2.28.1-gmp.7-gke.0"
        - "--image-config-reloader=gke.gcr.io/prometheus-engine/config-reloader:v0.3.3-gke.0"
        - "--image-rule-evaluator=gke.gcr.io/prometheus-engine/rule-evaluator:v0.3.3-gke.0"
        ports:
        - name: webhook
          # Note this should match the --listen-addr flag passed in to the operator args.
          # Default is 8443.
          containerPort: 8443
        - name: metrics
          # Note this should match the --metrics-addr flag passed in to the operator args.
          # Default is 18080.
          containerPort: 18080
        securityContext:
          allowPrivilegeEscalation: false
          privileged: false
          capabilities:
            drop:
            - all
          runAsUser: 1000
          runAsGroup: 1000