apiVersion: apps/v1
kind: Deployment
metadata:
  name: kuryr-controller
  namespace: openshift-kuryr
  annotations:
    kubernetes.io/description: |
      This deployment launches the kuryr-controller component.
    release.openshift.io/version: "{{.ReleaseVersion}}"
spec:
  selector:
    matchLabels:
      app: kuryr-controller
  # There can be only one kuryr-controller without HA enabled
  strategy:
    type: Recreate
  template:
    metadata:
      name: kuryr-controller
      labels:
        app: kuryr-controller
        component: network
        type: infra
        openshift.io/component: network
        configuration-hash: {{ .ConfigMapHash }}
    spec:
      serviceAccountName: kuryr
      hostNetwork: true
      priorityClassName: system-cluster-critical
      containers:
      - image: {{ .ControllerImage }}
        name: controller
{{ if eq (getOr . "ControllerEnableProbes" true) true }}
        readinessProbe:
          failureThreshold: 10
          httpGet:
            path: /ready
            port: {{ default 8091 .ControllerProbesPort }}
            scheme: HTTP
          timeoutSeconds: 20
          periodSeconds: 30
        livenessProbe:
          failureThreshold: 10
          httpGet:
            path: /alive
            port: {{ default 8091 .ControllerProbesPort }}
          initialDelaySeconds: 15
{{ end }}
        env:
        # Tell controller to talk to the apiserver directly.
        - name: KUBERNETES_SERVICE_PORT_HTTPS
          value: "{{.KUBERNETES_SERVICE_PORT}}"
        - name: KUBERNETES_SERVICE_HOST
          value: "{{.KUBERNETES_SERVICE_HOST}}"
        volumeMounts:
        - name: config-volume
          mountPath: "/etc/kuryr"
{{- if .UserCACertificate }}
        - name: user-ca-certificate-volume
          subPath: user-ca-bundle.crt
          mountPath: /etc/ssl/certs/user-ca-bundle.crt
{{- end }}
        ports:
        - name: metrics-port
          containerPort: 9654
      nodeSelector:
        node-role.kubernetes.io/master: ""
      tolerations:
      - key: "node-role.kubernetes.io/master"
        operator: "Exists"
        effect: "NoSchedule"
      - key: "node.kubernetes.io/not-ready"
        operator: "Exists"
        effect: "NoSchedule"
      volumes:
      - name: config-volume
        configMap:
          name: kuryr-config
{{- if .UserCACertificate }}
      - name: user-ca-certificate-volume
        configMap:
          name: user-ca-certificate
{{- end }}
