kind: Deployment
apiVersion: apps/v1
metadata:
  name: ibm-cloud-controller-manager
  namespace: openshift-cloud-controller-manager
  labels:
    k8s-app: ibm-cloud-controller-manager
spec:
  replicas: 2
  strategy:
    type: Recreate
  selector:
    matchLabels:
      k8s-app: ibm-cloud-controller-manager
  template:
    metadata:
      labels:
        k8s-app: ibm-cloud-controller-manager
    spec:
      priorityClassName: system-cluster-critical
      hostNetwork: true
      nodeSelector:
        node-role.kubernetes.io/master: ""
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - topologyKey: "kubernetes.io/hostname"
            labelSelector:
              matchLabels:
                k8s-app: ibm-cloud-controller-manager
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
        operator: Exists
      - effect: NoExecute
        key: node.kubernetes.io/unreachable
        operator: Exists
        tolerationSeconds: 120
      - effect: NoExecute
        key: node.kubernetes.io/not-ready
        operator: Exists
        tolerationSeconds: 120
      - effect: NoSchedule
        key: node.cloudprovider.kubernetes.io/uninitialized
        operator: Exists
      - effect: NoSchedule
        key: node.kubernetes.io/not-ready
        operator: Exists
      serviceAccountName: cloud-controller-manager
      terminationGracePeriodSeconds: 90
      containers:
      # Container is required to specify name in order for image substitution
      # to take place. Cloud-controller-manager is substituted with
      # real CCM image from the cluster
      - name: cloud-controller-manager
        image: quay.io/openshift/origin-ibm-cloud-controller-manager
        imagePullPolicy: IfNotPresent
        env:
          - name: POD_IP_ADDRESS
            valueFrom:
              fieldRef:
                fieldPath: status.podIP
          - name: VPCCTL_CLOUD_CONFIG
            value: /etc/ibm/cloud.conf
        command:
          - /bin/bash
          - -c
          - |
            #!/bin/bash
            set -o allexport
            if [[ -f /etc/kubernetes/apiserver-url.env ]]; then
              source /etc/kubernetes/apiserver-url.env
            fi
            exec /bin/ibm-cloud-controller-manager \
            --port=0 \
            --bind-address=$(POD_IP_ADDRESS) \
            --use-service-account-credentials=true \
            --configure-cloud-routes=false \
            --cloud-provider=ibm \
            --cloud-config=/etc/ibm/cloud.conf \
            --feature-gates=IPv6DualStack=false \
            --profiling=false \
            --leader-elect=true \
            --leader-elect-lease-duration=137s \
            --leader-elect-renew-deadline=107s \
            --leader-elect-retry-period=26s \
            --leader-elect-resource-namespace=openshift-cloud-controller-manager \
            --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_256_GCM_SHA384 \
            --v=2
        livenessProbe:
          httpGet:
            path: /healthz
            port: 10258
            scheme: HTTPS
          initialDelaySeconds: 300
          timeoutSeconds: 160
        ports:
          - containerPort: 10258
            name: https
            protocol: TCP
        resources:
          # Container is required to set pod requests, but not limits to satisfy CI
          # requirements for OpenShift on every scheduled workload in the cluster
          requests:
            cpu: 75m
            memory: 60Mi
        volumeMounts:
          - mountPath: /etc/kubernetes
            name: host-etc-kube
            readOnly: true
          - mountPath: /etc/ibm
            name: cloud-conf
          - mountPath: /etc/vpc
            name: ibm-cloud-credentials
      volumes:
        - name: host-etc-kube
          hostPath:
            path: /etc/kubernetes
            type: Directory
        - configMap:
            defaultMode: 420
            name: cloud-conf
          name: cloud-conf
        - secret:
            defaultMode: 420
            secretName: ibm-cloud-credentials
          name: ibm-cloud-credentials
