kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: openshift-authentication
  name: oauth-openshift
  labels:
    app: oauth-openshift
spec:
  replicas: 2
  selector:
    matchLabels:
      app: oauth-openshift
  template:
    metadata:
      namespace: openshift-authentication
      name: oauth-openshift
      labels:
        app: oauth-openshift
    spec:
      terminationGracePeriodSeconds: 40
      serviceAccountName: oauth-openshift
      nodeSelector:
        node-role.kubernetes.io/master: ''
      priorityClassName: system-cluster-critical
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: oauth-openshift
                topologyKey: kubernetes.io/hostname
      tolerations:
        - key: node-role.kubernetes.io/master
          operator: Exists
          effect: NoSchedule
        - key: node.kubernetes.io/unreachable
          operator: Exists
          effect: NoExecute
          tolerationSeconds: 120
        - key: node.kubernetes.io/not-ready
          operator: Exists
          effect: NoExecute
          tolerationSeconds: 120
      containers:
        - name: oauth-openshift
          image: ${IMAGE}
          command:
            - /bin/bash
            - '-ec'
          args:
            - |
              if [ -s /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle/ca-bundle.crt ]; then
                  echo "Copying system trust bundle"
                  cp -f /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle/ca-bundle.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
              fi
              exec oauth-server osinserver \
              --config=/var/config/system/configmaps/v4-0-config-system-cliconfig/v4-0-config-system-cliconfig \
              --v=${LOG_LEVEL}
          ports:
            - name: https
              containerPort: 6443
              protocol: TCP
          securityContext:
            readOnlyRootFilesystem: false # because of the `cp` in args
          volumeMounts:
            - name: v4-0-config-system-session
              readOnly: true
              mountPath: /var/config/system/secrets/v4-0-config-system-session
            - name: v4-0-config-system-cliconfig
              readOnly: true
              mountPath: /var/config/system/configmaps/v4-0-config-system-cliconfig
            - name: v4-0-config-system-serving-cert
              readOnly: true
              mountPath: /var/config/system/secrets/v4-0-config-system-serving-cert
            - name: v4-0-config-system-service-ca
              readOnly: true
              mountPath: /var/config/system/configmaps/v4-0-config-system-service-ca
            - name: v4-0-config-system-router-certs
              readOnly: true
              mountPath: /var/config/system/secrets/v4-0-config-system-router-certs
            - name: v4-0-config-system-ocp-branding-template
              readOnly: true
              mountPath: /var/config/system/secrets/v4-0-config-system-ocp-branding-template
            - name: v4-0-config-user-template-login
              readOnly: true
              mountPath: /var/config/user/template/secret/v4-0-config-user-template-login
            - name: v4-0-config-user-template-provider-selection
              readOnly: true
              mountPath: /var/config/user/template/secret/v4-0-config-user-template-provider-selection
            - name: v4-0-config-user-template-error
              readOnly: true
              mountPath: /var/config/user/template/secret/v4-0-config-user-template-error
            - name: v4-0-config-system-trusted-ca-bundle
              readOnly: true
              mountPath: /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle
          readinessProbe:
            httpGet:
              path: /healthz
              port: 6443
              scheme: HTTPS
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /healthz
              port: 6443
              scheme: HTTPS
            initialDelaySeconds: 30
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          lifecycle:
            # delay shutdown by 25s to ensure existing connections are drained
            # * 5s for endpoint propagation on delete
            # * 5s for route reload
            # * 15s for the longest running request to finish
            preStop:
              exec:
                command:
                - sleep
                - "25"
          terminationMessagePolicy: FallbackToLogsOnError
          resources:
            requests:
              cpu: 10m
              memory: 50Mi
      volumes:
        - name: v4-0-config-system-session
          secret:
            secretName: v4-0-config-system-session
        - name: v4-0-config-system-cliconfig
          configMap:
            name: v4-0-config-system-cliconfig
        - name: v4-0-config-system-serving-cert
          secret:
            secretName: v4-0-config-system-serving-cert
        - name: v4-0-config-system-service-ca
          configMap:
            name: v4-0-config-system-service-ca
        - name: v4-0-config-system-router-certs
          secret:
            secretName: v4-0-config-system-router-certs
        - name: v4-0-config-system-ocp-branding-template
          secret:
            secretName: v4-0-config-system-ocp-branding-template
        - name: v4-0-config-user-template-login
          secret:
            secretName: v4-0-config-user-template-login
            optional: true
        - name: v4-0-config-user-template-provider-selection
          secret:
            secretName: v4-0-config-user-template-provider-selection
            optional: true
        - name: v4-0-config-user-template-error
          secret:
            secretName: v4-0-config-user-template-error
            optional: true
        - name: v4-0-config-system-trusted-ca-bundle
          configMap:
            name: v4-0-config-system-trusted-ca-bundle
            optional: true
