apiVersion: apps/v1
kind: Deployment
metadata:
  name: ibm-iam-operator
  labels:
     app.kubernetes.io/instance: ibm-iam-operator
     app.kubernetes.io/managed-by: ibm-iam-operator
     app.kubernetes.io/name: ibm-iam-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      name: ibm-iam-operator
  template:
    metadata:
      labels:
        name: ibm-iam-operator
        app.kubernetes.io/instance: ibm-iam-operator
        app.kubernetes.io/managed-by: ibm-iam-operator
        app.kubernetes.io/name: ibm-iam-operator
      annotations:
        productName: IBM Cloud Platform Common Services
        productID: "068a62892a1e4db39641342e592daa25"
        productMetric: FREE
    spec:
      serviceAccountName: ibm-iam-operator
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      containers:
        - name: ibm-iam-operator
          # Replace this with the built image name
          image: quay.io/opencloudio/ibm-iam-operator:latest
          command:
          - ibm-iam-operator
          imagePullPolicy: Always
          env:
            - name: AUTH_SERVICE_TAG_OR_SHA
              value: "sha256:acff27adac74cc058c72e735317502d5ef1f54f8b9b8bb46e921d779740ecb2c"
            - name: IDENTITY_PROVIDER_TAG_OR_SHA
              value: "sha256:3c730d8aadc2490e8af87e9d65b18887f486059666a5ec92c45815471f6baba2"
            - name: IDENTITY_MANAGER_TAG_OR_SHA
              value: "sha256:5d8eb877e50bc71ba779faaf98159c9b1755a3f6c38fcad64f938a0280c250c6"
            - name: POLICY_ADMINISTRATION_TAG_OR_SHA
              value: "sha256:67e37da717419c7ee0834d185f280c302db43737fb9b315ffd729e2ec2571b42"
            - name: POLICY_DECISION_TAG_OR_SHA
              value: "sha256:a696d99a9baf53fc3b1048a79993b30acb8cf563115e2aa3220fe8bd285e2ff9"
            - name: SECRET_WATCHER_TAG_OR_SHA
              value: "sha256:85fc756b043bf9a4800e601353490f0cf7822a294d22698315f3f31b9dd74080"
            - name: CLIENT_WATCHER_TAG_OR_SHA
              value: "sha256:39fd0ae3e671f82baecd89f3c41943878abe7d0fe8f64f1286a87a56d95feb42"
            - name: POLICY_CONTROLLER_TAG_OR_SHA
              value: "sha256:d080f925186f92348892d63799d1cdb0e18cc82c710b162992d3229aac89f454"
            - name: IAM_ONBOARDING_TAG_OR_SHA
              value: "sha256:bb3efc1064f642bd86ddfc2268dcfe164399a77a23f28d376b7a2163d59a614a"
            - name: AUDIT_TAG_OR_SHA
              value: "sha256:4d68ee3e14b74e117b54e1c49686de847008d5e453b267168f6e52af9c9e9d4d"
            - name: WATCH_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: "ibm-iam-operator"
          resources:
            limits:
              cpu: 25m
              memory: 320Mi
            requests:
              cpu: 10m
              memory: 80Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: true
