cert-manager-operator/config/manager/manager.yaml at b550fd8e5c649eae3ced1053dfb1e2ac3a944dd2 · openshift/cert-manager-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/name: namespace
    app.kubernetes.io/instance: system
    app.kubernetes.io/component: manager
    app.kubernetes.io/created-by: cert-manager-operator
    app.kubernetes.io/part-of: cert-manager-operator
    app.kubernetes.io/managed-by: kustomize
  name: system
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: controller-manager
  namespace: system
  labels:
    app.kubernetes.io/name: deployment
    app.kubernetes.io/instance: controller-manager
    app.kubernetes.io/component: manager
    app.kubernetes.io/created-by: cert-manager-operator
    app.kubernetes.io/part-of: cert-manager-operator
    app.kubernetes.io/managed-by: kustomize
spec:
  selector:
    matchLabels:
      name: cert-manager-operator
  replicas: 1
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: cert-manager-operator
      labels:
        name: cert-manager-operator
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                - key: kubernetes.io/arch
                  operator: In
                  values:
                    - amd64
                    - arm64
                    - ppc64le
                    - s390x
                - key: kubernetes.io/os
                  operator: In
                  values:
                    - linux
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - command:
            - /usr/bin/cert-manager-operator
          args:
            - start
            - '--v=$(OPERATOR_LOG_LEVEL)'
            - '--trusted-ca-configmap=$(TRUSTED_CA_CONFIGMAP_NAME)'
            - '--cloud-credentials-secret=$(CLOUD_CREDENTIALS_SECRET_NAME)'
            - '--unsupported-addon-features=$(UNSUPPORTED_ADDON_FEATURES)'
          env:
            - name: WATCH_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.annotations['olm.targetNamespaces']
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: cert-manager-operator
            - name: RELATED_IMAGE_CERT_MANAGER_WEBHOOK
              value: quay.io/jetstack/cert-manager-webhook:v1.20.3
            - name: RELATED_IMAGE_CERT_MANAGER_CA_INJECTOR
              value: quay.io/jetstack/cert-manager-cainjector:v1.20.3
            - name: RELATED_IMAGE_CERT_MANAGER_CONTROLLER
              value: quay.io/jetstack/cert-manager-controller:v1.20.3
            - name: RELATED_IMAGE_CERT_MANAGER_ACMESOLVER
              value: quay.io/jetstack/cert-manager-acmesolver:v1.20.3
            - name: RELATED_IMAGE_CERT_MANAGER_ISTIOCSR
              value: quay.io/jetstack/cert-manager-istio-csr:v0.16.0
            - name: RELATED_IMAGE_CERT_MANAGER_TRUST_MANAGER
              value: quay.io/jetstack/trust-manager:v0.20.3
            - name: OPERAND_IMAGE_VERSION
              value: 1.20.3
            - name: ISTIOCSR_OPERAND_IMAGE_VERSION
              value: 0.16.0
            - name: TRUSTMANAGER_OPERAND_IMAGE_VERSION
              value: 0.20.3
            - name: OPERATOR_IMAGE_VERSION
              value: 1.20.0
            - name: OPERATOR_LOG_LEVEL
              value: '2'
            - name: TRUSTED_CA_CONFIGMAP_NAME
            - name: CLOUD_CREDENTIALS_SECRET_NAME
            - name: UNSUPPORTED_ADDON_FEATURES
          image: controller:latest
          imagePullPolicy: IfNotPresent
          name: cert-manager-operator
          livenessProbe:
            httpGet:
              path: /healthz
              port: https
              scheme: HTTPS
            initialDelaySeconds: 15
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /readyz
              port: https
              scheme: HTTPS
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - 'ALL'
            privileged: false
            runAsNonRoot: true
            readOnlyRootFilesystem: true
            seccompProfile:
              type: 'RuntimeDefault'
          ports:
          - containerPort: 8443
            name: https
            protocol: TCP
          resources:
            requests:
              cpu: 10m
              memory: 32Mi
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      serviceAccountName: controller-manager
      terminationGracePeriodSeconds: 10
      volumes:
        - name: tmp
          emptyDir: {}