apiVersion: apps/v1
kind: Deployment
metadata:
  name: manager
  labels:
    control-plane: manager
spec:
  selector:
    matchLabels:
      control-plane: manager
  replicas: {{ .Values.replicas }}
  template:
    metadata:
      labels:
        control-plane: manager
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
    spec:
      securityContext:
        runAsNonRoot: true
      containers:
      - command:
        - /manager
        args:
        - --enable-leader-election
        image: {{ .Values.image }}
        imagePullPolicy: {{ .Values.imagePullPolicy }}
        name: manager
        env:
        - name: NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CONNECTION_IDLE_DELAY
          value: "3s"
        - name: O11Y_AUTH0_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: o11y-auth0-client
              key: o11yAuth0ClientID
        - name: O11Y_AUTH0_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: o11y-auth0-client
              key: o11yAuth0ClientSecret
        - name: O11Y_GLOBAL_READ_URL
          valueFrom:
            configMapKeyRef:
              name: o11y-config
              key: global.readRemote
        - name: O11Y_GLOBAL_CLUSTER_ID
          valueFrom:
            configMapKeyRef:
              name: o11y-config
              key: global.clusterID
        - name: O11Y_GLOBAL_CONTROL_PLANE_INFO
          valueFrom:
            configMapKeyRef:
              name: o11y-config
              key: global.controlPlaneInfo
        - name: O11Y_GLOBAL_VM_ACCOUNTID
          valueFrom:
            configMapKeyRef:
              name: o11y-config
              key: global.vmAccountID
        securityContext:
          allowPrivilegeEscalation: false
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8000
            scheme: HTTPS
          initialDelaySeconds: 10
          timeoutSeconds: 2
          periodSeconds: 20
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8000
            scheme: HTTPS
          initialDelaySeconds: 10
          timeoutSeconds: 2
          periodSeconds: 5
        resources:
          limits:
            cpu: 2000m
            memory: 4Gi
          requests:
            cpu: 400m
            memory: 2Gi
        volumeMounts:
        - name: infra-api-kubeconfig
          mountPath: /infra
        - mountPath: /certs
          name: cert
          readOnly: true
        - mountPath: /cluster-cert
          name: cluster-cert
          readOnly: true
        - mountPath: /infra-redis-client-cert
          name: infra-redis-client-cert
          readOnly: true
      serviceAccountName: manager
      priorityClassName: system-node-critical
      terminationGracePeriodSeconds: 10
      volumes:
      - name: infra-api-kubeconfig
        secret:
          secretName: infra-api-kubeconfig
      - name: cert
        secret:
          defaultMode: 420
          secretName: manager-cert-secret
      - name: cluster-cert
        secret:
          defaultMode: 420
          secretName: manager-cluster-client-secret
      - name: infra-redis-client-cert
        secret:
          defaultMode: 420
          secretName: manager-infra-redis-client-secret