---
apiVersion: {{ include "deploymentversion" . }}
kind: Deployment
metadata:
  name: gardener-seed-admission-controller
  namespace: {{ .Release.Namespace }}
  labels:
    app: gardener
    role: seed-admission-controller
spec:
  revisionHistoryLimit: 0
  replicas: {{ .Values.gardenerSeedAdmissionController.replicas }}
  selector:
    matchLabels:
      app: gardener
      role: seed-admission-controller
  template:
    metadata:
      labels:
        app: gardener
        role: seed-admission-controller
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: labels
                operator: In
                values:
                - gardener
              - key: role
                operator: In
                values:
                - seed-admission-controller
            topologyKey: kubernetes.io/hostname
      containers:
      - name: gardener-seed-admission-controller
        image: {{ index .Values.global.images "gardener-seed-admission-controller" }}
        imagePullPolicy: IfNotPresent
        command:
        - /gardener-seed-admission-controller
        - --port=443
        - --tls-cert-path=/srv/gardener-seed-admission-controller/tls.crt
        - --tls-private-key-path=/srv/gardener-seed-admission-controller/tls.key
        {{- if .Values.gardenerSeedAdmissionController.resources }}
        resources:
{{ toYaml .Values.gardenerSeedAdmissionController.resources | indent 10 }}
        {{- end }}
        volumeMounts:
          - mountPath: /srv/gardener-seed-admission-controller
            name: gardener-seed-admission-controller-tls
            readOnly: true
      serviceAccountName: gardener-seed-admission-controller
      volumes:
        - name: gardener-seed-admission-controller-tls
          secret:
            secretName: gardener-seed-admission-controller-tls