apiVersion: apps/v1
kind: Deployment
metadata:
  name: config-manager
spec:
  template:
    spec:
      containers:
        - name: manager
          image: gcr.io/pingcap-public/config-manager:v0.151.1
          args:
          - --leader-elect
          - --zap-devel=false
          - --activity
          - --activity-config=/etc/config-manager/activity.yaml
          - --ghapp-private-key-file=/etc/config-manager/ghapp-private-key.pem
          - --ghapp-app-id=340871
          - --ghapp-install-id=38097753
          - --jump-endpoint=https://ops.tidbcloud.com/configchange
          - --cluster-ns-prefix=prod-
          - --api-bind-address=:8082
          - --config-revision-ttl=168h0m0s
          - --config-path=/etc/config-manager/config.yaml
          env:
          - name: KUBECONFIG
            value: /.kube/config
          - name: GCP_WORKLOAD_IDENTITY_AUDIENCE
            value: //iam.googleapis.com/projects/301623017899/locations/global/workloadIdentityPools/prod-dbaas/providers/prod-dbaas-eks-oidc
          - name: GCP_IMPERSONATE_SA
            value: prod-prod-central@dbaas-prod.iam.gserviceaccount.com
          - name: TIINF_POD_NAME
            value: "config-manager-dummy1-dummy2"
          - name: GOOGLE_APPLICATION_CREDENTIALS
            value: /gcloud-config/application_default_credentials.json
          - name: PROXY_AUTH0_CLIENT_ID
            valueFrom:
              secretKeyRef:
                name: proxy-auth0-client
                key: Auth0ClientID
          - name: PROXY_AUTH0_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: proxy-auth0-client
                key: Auth0ClientSecret
          - name: CLINIC_ACTIVITY_TOKEN
            valueFrom:
              secretKeyRef:
                name: config-manager-gcp-credential-config
                key: clinic_activity_token
          resources:
            limits:
              memory: 4Gi
            requests:
              memory: 1Gi
          volumeMounts:
          - name: bizconfig
            mountPath: /etc/config-manager
          - name: config-manager-gcp-credential-config
            mountPath: /gcloud-config/
      serviceAccountName: central
      volumes:
        - name: kubeconfig
          secret:
            secretName: config-manager-infra-kubeconfig
        - name: bizconfig
          projected:
            sources:
            - secret:
                name: config-manager-ghapp-private-key
            - configMap:
                name: config-manager-activity-config
            - configMap:
                name: config-manager-config
        - name: config-manager-gcp-credential-config
          secret:
            secretName: config-manager-gcp-credential-config