apiVersion: apps/v1
kind: Deployment
metadata:
  name: gardener-provider
spec:
  selector:
    matchLabels:
      app: gardener-provider
  template:
    metadata:
      labels:
        app: gardener-provider
    spec:
      containers:
        - args:
            - --leader-elect
            - --enable-o11y-agent
            - --config
            - /etc/infra-api/config.yaml
            - --zap-devel
            - "false"
          command:
            - /manager
          env:
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /.gcp/credentials.json
            - name: KUBECONFIG
              value: /.kube/config
            - name: AWS_DEFAULT_REGION
              value: us-west-2
            - name: AWS_REGION
              value: us-west-2
            - name: ENABLE_TRACING
              value: "true"
            - name: PROXY_AUTH0_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  key: Auth0ClientID
                  name: proxy-auth0-client
            - name: PROXY_AUTH0_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  key: Auth0ClientSecret
                  name: proxy-auth0-client
            - name: O11Y_AUTH0_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  key: Auth0ClientID
                  name: o11y-auth0-client
            - name: O11Y_AUTH0_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  key: Auth0ClientSecret
                  name: o11y-auth0-client
          image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/dbaas/infra-api/infra-provider:48b181832d1f0f7f26bb1daa54ded8da13d7cdcb
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 8081
              scheme: HTTP
            initialDelaySeconds: 15
            periodSeconds: 20
            successThreshold: 1
            timeoutSeconds: 1
          name: manager
          ports:
            - containerPort: 9443
              name: webhook-server
              protocol: TCP
          readinessProbe:
            failureThreshold: 10
            httpGet:
              path: /readyz
              port: 8081
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            limits:
              cpu: 3000m
              memory: 6000Mi
            requests:
              cpu: 100m
              memory: 100Mi
          volumeMounts:
            - mountPath: /.gcp
              name: gcp
            - mountPath: /.kube
              name: kubeconfig
            - mountPath: /etc/infra-api
              name: config
            - mountPath: /gardener
              name: gardener
            - mountPath: /tmp/k8s-webhook-server/serving-certs
              name: cert
      serviceAccount: infra-provider
      volumes:
        - name: gcp
          secret:
            defaultMode: 420
            secretName: gardener-provider-gcp-credentials
        - name: kubeconfig
          secret:
            defaultMode: 420
            secretName: gardener-provider-infra-kubeconfig # infra apisrever kubeconfig
        - configMap:
            defaultMode: 420
            name: gardener-provider-config
          name: config
        - name: gardener
          secret:
            defaultMode: 420
            secretName: gardener-provider-gardener-kubeconfig # gardener apiserver kubeconfig
        - name: cert
          secret:
            defaultMode: 420
            # The webhook certificate is generated by Pulumi using cert-manager
            # https://github.com/tidbcloud/infra-cd/blob/d14165747cda70945a29935595d939d74f59e5b1/apiserver.ts#L243
            secretName: infra-webhook-cert