command-cert-manager-issuer/deploy/charts/command-cert-manager-issuer/templates/deployment.yaml at ff50682c8bc4d589feb70fb5d06521f5e729948c · slammajamma28/command-cert-manager-issuer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "command-cert-manager-issuer.fullname" . }}
  labels:
    {{- include "command-cert-manager-issuer.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "command-cert-manager-issuer.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "command-cert-manager-issuer.selectorLabels" . | nindent 8 }}
        {{- with .Values.podLabels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "command-cert-manager-issuer.serviceAccountName" . }}
      {{- if not .Values.serviceAccount.automountServiceAccountToken }}
      automountServiceAccountToken: false
      {{- end }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      {{- if not .Values.serviceAccount.automountServiceAccountToken }}
      volumes:
        - name: serviceaccount-token
          projected:
            defaultMode: {{ .Values.serviceAccount.projectedTokenVolume.defaultMode }}
            sources:
              - serviceAccountToken:
                  expirationSeconds: {{ .Values.serviceAccount.projectedTokenVolume.expirationSeconds }}
                  path: token
              - configMap:
                  name: kube-root-ca.crt
                  items:
                    - key: ca.crt
                      path: ca.crt
              - downwardAPI:
                  items:
                    - path: namespace
                      fieldRef:
                        apiVersion: v1
                        fieldPath: metadata.namespace
      {{- end }}
      containers:
        - args:
            - --health-probe-bind-address=:8081
            - --metrics-bind-address=127.0.0.1:8080
            - --leader-elect
            {{- if .Values.secretConfig.useClusterRoleForSecretAccess}}
            - --secret-access-granted-at-cluster-level
            {{- end}}
            {{- if .Values.secretConfig.useClusterRoleForConfigMapAccess}}
            - --configmap-access-granted-at-cluster-level
            {{- end}}
            {{- if .Values.defaultHealthCheckInterval }}
            - --default-health-check-interval={{ .Values.defaultHealthCheckInterval }}
            {{- end }}
          command:
            - /manager
          {{- with .Values.env }}
          env:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 15
            periodSeconds: 20
          name: {{ .Chart.Name }}
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          {{- if not .Values.serviceAccount.automountServiceAccountToken }}
          volumeMounts:
            - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
              name: serviceaccount-token
              readOnly: true
          {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/arch
                    operator: In
                    values:
                      - amd64
                      - arm64
                      - ppc64le
                      - s390x
                  - key: kubernetes.io/os
                    operator: In
                    values:
                      - linux
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
      {{- end }}
      terminationGracePeriodSeconds: 10