apiVersion: apps/v1
kind: Deployment
metadata:
  name: config-manager
spec:
  template:
    spec:
      containers:
        - name: manager
          image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/config-manager:7cea0f64c26e048bc22555ab88779aa0ae97693a
          args:
          - --leader-elect
          - --zap-devel=false
          - --activity
          - --activity-config=/etc/config-manager/activity.yaml
          - --ghapp-private-key-file=/etc/config-manager/ghapp-private-key.pem
          - --ghapp-app-id=340871
          - --ghapp-install-id=38097753
          - --jump-endpoint=https://ops-dev.tidbcloud.com/configchange
          - --cluster-ns-prefix=nightly-ms-
          - --api-bind-address=:8082
          - --config-revision-ttl=168h0m0s
          - --config-path=/etc/config-manager/config.yaml
          env:
          - name: KUBECONFIG
            value: /.kube/config
          - name: GCP_WORKLOAD_IDENTITY_AUDIENCE
            value: /iam.googleapis.com/projects/27323915999/locations/global/workloadIdentityPools/dev-dbaas/providers/dev-dbaas-eks-oidc
          - name: GCP_IMPERSONATE_SA
            value: dev-nightly-central@pingcap-gardener.iam.gserviceaccount.com
          - name: GOOGLE_APPLICATION_CREDENTIALS
            value: /gcloud-config/application_default_credentials.json
          - name: PROXY_AUTH0_CLIENT_ID
            valueFrom:
              secretKeyRef:
                name: proxy-auth0-client
                key: Auth0ClientID
          - name: PROXY_AUTH0_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: proxy-auth0-client
                key: Auth0ClientSecret
          - name: CLINIC_ACTIVITY_TOKEN
            valueFrom:
              secretKeyRef:
                name: config-manager-gcp-credential-config
                key: clinic_activity_token
          volumeMounts:
          - name: bizconfig
            mountPath: /etc/config-manager
          - name: config-manager-gcp-credential-config
            mountPath: /gcloud-config/
      serviceAccountName: central
      volumes:
        - name: kubeconfig
          secret:
            secretName: config-manager-infra-kubeconfig
        - name: bizconfig
          projected: 
            sources:
            - secret:
                name: config-manager-ghapp-private-key
            - configMap:
                name: config-manager-activity-config
            - configMap:
                name: config-manager-config
        - name: config-manager-gcp-credential-config
          secret:
            secretName: config-manager-gcp-credential-config