apiVersion: v1
kind: ServiceAccount
metadata:
  name: vm-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: vm-operator
rules:
  - apiGroups: [""]
    resources: ["configmaps", "endpoints", "events", "persistentvolumeclaims", "pods", "secrets", "serviceaccounts", "services"]
    verbs: ["*"]
  - apiGroups: ["apps"]
    resources: ["deployments", "deployments/finalizers", "statefulsets"]
    verbs: ["*"]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["*"]
  - apiGroups: ["policy"]
    resources: ["poddisruptionbudgets"]
    verbs: ["*"]
  - apiGroups: ["monitoring.coreos.com"]
    resources: ["prometheusrules"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["operator.victoriametrics.com"]
    resources: ["vmclusters", "vmclusters/finalizers", "vmclusters/status"]
    verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: vm-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: vm-operator
subjects:
  - kind: ServiceAccount
    name: vm-operator
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vm-operator
  labels:
    app.kubernetes.io/name: vm-operator
    app.kubernetes.io/part-of: cp9-o11y
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: vm-operator
  template:
    metadata:
      labels:
        app.kubernetes.io/name: vm-operator
        app.kubernetes.io/part-of: cp9-o11y
    spec:
      serviceAccountName: vm-operator
      containers:
        - name: manager
          image: docker.io/victoriametrics/operator@sha256:e9d78c1d5effee712547dda5f9e1cf90b574fa74cd15291d8a39822219082b9a
          args:
            - --leader-elect
            - --controller.disableCRDOwnership=true
            - --controller.disableReconcileFor=VMAgent,VMAnomaly,VMAuth,VMSingle,VLAgent,VLogs,VLSingle,VLCuster,VMAlertmanager,VMAlert,VMUser,VMRule,VMAlertmanagerConfig,VMServiceScrape,VMPodScrape,VMProbe,VMNodeScrape,VMStaticScrape,VMScrapeConfig
            - --health-probe-bind-address=:8081
            - --metrics-bind-address=:8080
          env:
            - name: WATCH_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: VM_DISABLESELFSERVICESCRAPECREATION
              value: "true"
          ports:
            - name: metrics
              containerPort: 8080
            - name: health
              containerPort: 8081
          readinessProbe:
            httpGet:
              path: /ready
              port: health
            initialDelaySeconds: 5
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /health
              port: health
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault