03-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    config.openshift.io/inject-proxy: cloud-credential-operator
    exclude.release.openshift.io/internal-openshift-hosted: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
  name: cloud-credential-operator
  namespace: openshift-cloud-credential-operator
spec:
  replicas: 1
  revisionHistoryLimit: 4
  selector:
    matchLabels:
      control-plane: controller-manager
      controller-tools.k8s.io: "1.0"
  strategy:
    type: Recreate
  template:
    metadata:
      annotations:
        target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
      labels:
        app: cloud-credential-operator
        control-plane: controller-manager
        controller-tools.k8s.io: "1.0"
    spec:
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
      - args:
        - --secure-listen-address=0.0.0.0:8443
        - --upstream=http://127.0.0.1:2112/
        - --tls-cert-file=/etc/tls/private/tls.crt
        - --tls-private-key-file=/etc/tls/private/tls.key
        - --logtostderr=true
        image: quay.io/openshift/origin-kube-rbac-proxy:latest
        imagePullPolicy: IfNotPresent
        name: kube-rbac-proxy
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
        ports:
        - containerPort: 8443
          name: metrics
          protocol: TCP
        resources:
          requests:
            memory: 20Mi
            cpu: 10m
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /etc/tls/private
          name: cloud-credential-operator-serving-cert
      - args:
        - |
          if [ -s /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem ]; then
              echo "Copying system trust bundle"
              cp -f /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
          fi
          exec /usr/bin/cloud-credential-operator operator
        command:
        - /bin/bash
        - -ec
        env:
        - name: RELEASE_VERSION
          value: 0.0.1-snapshot
        - name: AZURE_POD_IDENTITY_WEBHOOK_IMAGE
          value: quay.io/openshift/azure-workload-identity-webhook:latest
        - name: AWS_POD_IDENTITY_WEBHOOK_IMAGE
          value: quay.io/openshift/aws-pod-identity-webhook:latest
        image: quay.io/openshift/origin-cloud-credential-operator:latest
        imagePullPolicy: IfNotPresent
        name: cloud-credential-operator
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
        resources:
          requests:
            cpu: 10m
            memory: 20Mi
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /var/run/configmaps/trusted-ca-bundle
          name: cco-trusted-ca
      nodeSelector:
        node-role.kubernetes.io/master: ""
      priorityClassName: system-cluster-critical
      serviceAccountName: cloud-credential-operator
      terminationGracePeriodSeconds: 10
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
        operator: Exists
      - effect: NoExecute
        key: node.kubernetes.io/unreachable
        operator: Exists
        tolerationSeconds: 120
      - effect: NoExecute
        key: node.kubernetes.io/not-ready
        operator: Exists
        tolerationSeconds: 120
      volumes:
      - configMap:
          items:
          - key: ca-bundle.crt
            path: tls-ca-bundle.pem
          name: cco-trusted-ca
          optional: true
        name: cco-trusted-ca
      - name: cloud-credential-operator-serving-cert
        secret:
          secretName: cloud-credential-operator-serving-cert