50_cloud-ingress-operator.Deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: cloud-ingress-operator
  namespace: openshift-cloud-ingress-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      name: cloud-ingress-operator
  template:
    metadata:
      labels:
        name: cloud-ingress-operator
    spec:
      serviceAccountName: cloud-ingress-operator
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: node-role.kubernetes.io/infra
                operator: Exists
            weight: 1
      tolerations:
      - operator: Exists
        key: node-role.kubernetes.io/infra
        effect: NoSchedule
      volumes:
      - configMap:
          defaultMode: 420
          items:
            - key: ca-bundle.crt
              path: tls-ca-bundle.pem
          name: trusted-ca-bundle
        name: trusted-ca-bundle
      - name: bound-sa-token
        projected:
          sources:
          - serviceAccountToken:
              path: token
              audience: openshift
      containers:
        - name: cloud-ingress-operator
          # Replace this with the built image name
          image: REPLACE_IMAGE
          command:
          - cloud-ingress-operator
          imagePullPolicy: Always
          env:
            # "" so that the cache can read objects outside its namespace
            - name: WATCH_NAMESPACE
              value: "openshift-cloud-ingress-operator,openshift-ingress,openshift-ingress-operator,openshift-kube-apiserver,openshift-machine-api"
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: "cloud-ingress-operator"
          resources:
            requests:
              cpu: "200m"
            limits:
              memory: "4G"
              cpu: "200m"
          livenessProbe:
            httpGet:
              path: /healthz
              scheme: HTTP
              port: 8000
            initialDelaySeconds: 45
            periodSeconds: 75
          volumeMounts:
          - mountPath: /etc/pki/ca-trust/extracted/pem
            name: trusted-ca-bundle
            readOnly: true
          - name: bound-sa-token
            mountPath: /var/run/secrets/openshift/serviceaccount