stack/components/operator/helm/templates/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "operator.fullname" . }}
  labels:
    {{- include "operator.labels" . | nindent 4 }}
    control-plane: controller-manager
spec:
  selector:
    matchLabels:
      {{- include "operator.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "operator.selectorLabels" . | nindent 8 }}
        control-plane: controller-manager
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: controller-manager
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command:
            - /usr/bin/operator
          args:
            {{- with .Values.operator.metricsAddr }}
            - --metrics-bind-address={{ $.Values.operator.metricsAddr }}
            {{- end }}
            {{- with .Values.operator.probeAddr }}
            - --health-probe-bind-address={{ $.Values.operator.probeAddr }}
            {{- end }}
            {{- with .Values.operator.enableLeaderElection }}
            - --leader-elect
            {{- end }}
            {{- with .Values.operator.env }}
            - --env={{ $.Values.operator.env }}
            {{- end }}
            {{- with .Values.operator.region }}
            - --region={{ $.Values.operator.region }}
            {{- end }}
            {{- if .Values.operator.disableWebhooks }}
            - --disable-webhooks
            {{- end }}
            - --enable-stack-finalizer={{ .Values.operator.enableStackFinalizer }}
          ports:
          - containerPort: 9443
            name: webhook-server
            protocol: TCP
          livenessProbe:
            httpGet:
              path: /healthz
              port: {{ regexReplaceAll ":" .Values.operator.probeAddr "" | default "8081" }}
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /readyz
              port: {{ regexReplaceAll ":" .Values.operator.probeAddr "" | default "8081" }}
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          volumeMounts:
            - mountPath: /tmp/k8s-webhook-server/serving-certs
              name: cert
              readOnly: true
        - args:
          - --secure-listen-address=0.0.0.0:8443
          - --upstream=http://127.0.0.1{{- .Values.operator.metricsAddr | default ":8080" -}}/
          - --logtostderr=true
          - --v=0
          image: gcr.io/kubebuilder/kube-rbac-proxy:v0.12.0
          name: kube-rbac-proxy
          ports:
          - containerPort: 8443
            name: https
            protocol: TCP
          resources:
            limits:
              cpu: 500m
              memory: 128Mi
            requests:
              cpu: 5m
              memory: 64Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
        - name: cert
          secret:
            defaultMode: 420
            secretName: webhook-server-cert