apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    pingcap.com/cluster: db
    pingcap.com/component: cluster-agent
  labels:
    app.kubernetes.io/instance: cluster-agent
    app.kubernetes.io/name: cluster-agent
  name: cluster-agent
  namespace: tidb{{!ClusterId}}
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/instance: cluster-agent
      app.kubernetes.io/name: cluster-agent
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: cluster-agent
        app.kubernetes.io/name: cluster-agent
{{!exist begin!AuditEnabled}}
      annotations:
        tidbcloud.com/audit-config: |
          {{!AuditSidecarConfig}}
{{!exist end!AuditEnabled}}
    spec:
      containers:
      - command:
        - /cluster-agent
        - --provider
        - {{!Provider}}
        - --region
        - {{!Region}}
        - --tls-cert-file
        - /server-ssl/tls.crt
        - --tls-key-file
        - /server-ssl/tls.key
{{!exist begin!PrivilegedTiDBDeactivationWait}}
        - --privileged-tidb-deactivation-wait
        - {{!PrivilegedTiDBDeactivationWait}}
{{!exist end!PrivilegedTiDBDeactivationWait}}
{{!exist begin!AuditLogEnabled}}
        - --audit-enabled
        - --audit-file-path
        - /var/log/cluster-agent/ops-audit.log
        - --audit-max-body-size
        - "0"
{{!exist end!AuditLogEnabled}}
        env:
        - name: NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CSE_CTL_PATH
          value: /opt/other-binary/cse-ctl
        - name: PD_CTL_PATH
          value: /opt/other-binary/pd-ctl
        - name: REPLACE_NODE_WARMUP_IMAGE
          value: {{!ReplaceNodeWarmUpImage}}
        image: {{!ClusterAgentImage}}
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: https
            scheme: HTTPS
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: cluster-agent
        ports:
        - containerPort: 8080
          name: https
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: https
            scheme: HTTPS
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          limits:
            memory: 500Mi
          requests:
            cpu: 20m
            memory: 20Mi
        securityContext: 
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          privileged: false
          capabilities:
            drop:
              - NET_RAW
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /client-ssl
          name: client-ssl
        - mountPath: /server-ssl
          name: server-ssl
          readOnly: true
        - mountPath: /opt/other-binary
          name: other-binary
{{!exist begin!AuditEnabled}}
        - mountPath: /var/log/cluster-agent
          name: audit-log
{{!exist end!AuditEnabled}}
        workingDir: /tmp
{{!exist begin!AuditEnabled}}
      - name: auditlog
        image: {{!AuditLogImage}}
        imagePullPolicy: {{!ImagePullPolicy}}
        ports:
        - containerPort: 9090
          name: metrics
          protocol: TCP
        resources:
          limits:
            cpu: 100m
            memory: 256Mi
          requests:
            cpu: 100m
            memory: 256Mi
        securityContext:
          runAsUser: 1000
          runAsGroup: 2000
          allowPrivilegeEscalation: false
          capabilities:
            drop:
              - NET_RAW
          privileged: false
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /var/log/cluster-agent
          name: audit-log
        - mountPath: /etc/podinfo
          name: podinfo
          readOnly: true
        command:
        - /audit-ng
        - server
        - --config=/etc/podinfo/audit-config.yaml
        env:
        - name: TZ
          value: UTC
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
{{!exist end!AuditEnabled}}
      dnsPolicy: ClusterFirst
      initContainers:
      - command:
        - cp
        - /cse-ctl
        - /opt/other-binary/cse-ctl
        image: {{!TiKVImage}}
        imagePullPolicy: {{!ImagePullPolicy}}
        name: copy-cse-ctl
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /opt/other-binary
          name: other-binary
        workingDir: /opt/other-binary
      - command:
        - cp
        - /pd-ctl
        - /opt/other-binary/
        image: {{!PDImage}}
        imagePullPolicy: {{!ImagePullPolicy}}
        name: copy-pd-ctl
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /opt/other-binary
          name: other-binary
        workingDir: /opt/other-binary
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext:
        runAsUser: 1000
        runAsGroup: 2000
        fsGroup: 2000
        runAsNonRoot: true
      serviceAccountName: cluster-agent
      terminationGracePeriodSeconds: 30
      volumes:
      - name: client-ssl
        secret:
          defaultMode: 420
          secretName: db-cluster-client-secret
      - name: server-ssl
        secret:
          defaultMode: 420
          secretName: cluster-agent-server-secret
      - emptyDir: {}
        name: other-binary
{{!exist begin!AuditEnabled}}
      - name: podinfo
        downwardAPI:
          defaultMode: 420
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.annotations['tidbcloud.com/audit-config']
            path: audit-config.yaml
      - name: audit-log
        ephemeral:
          volumeClaimTemplate:
            spec:
              storageClassName: {{!AuditStorageClass}}
              resources:
                requests:
                  storage: {{!AuditStorageSize}}
              accessModes:
              - ReadWriteOnce
{{!exist end!AuditEnabled}}