machine-config-operator/manifests/machineconfigcontroller/deployment.yaml at b25e570a8a06f037b77428e45ba83826b4887078 · yuqi-zhang/machine-config-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
apiVersion: apps/v1
kind: Deployment
metadata:
  name: machine-config-controller
  namespace: {{.TargetNamespace}}
spec:
  selector:
    matchLabels:
      k8s-app: machine-config-controller
  template:
    metadata:
      labels:
        k8s-app: machine-config-controller
      annotations:
        target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
    spec:
      containers:
      - name: machine-config-controller
        image: {{.Images.MachineConfigOperator}}
        command: ["/usr/bin/machine-config-controller"]
        args:
        - "start"
        - "--resourcelock-namespace={{.TargetNamespace}}"
        - "--v=2"
        resources:
          requests:
            cpu: 20m
            memory: 50Mi
        terminationMessagePolicy: FallbackToLogsOnError
      - name: oauth-proxy
        image: {{.Images.OauthProxy}}
        ports:
        - containerPort: 9001
          name: metrics
          protocol: TCP
        args:
        - --https-address=:9001
        - --provider=openshift
        - --openshift-service-account=machine-config-controller
        - --upstream=http://127.0.0.1:8797
        - --tls-cert=/etc/tls/private/tls.crt
        - --tls-key=/etc/tls/private/tls.key
        - --cookie-secret-file=/etc/tls/cookie-secret/cookie-secret
        - '--openshift-sar={"resource": "namespaces", "verb": "get"}'
        - '--openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get"}}'
        resources:
          requests:
            cpu: 20m
            memory: 50Mi
        volumeMounts:
        - mountPath: /etc/tls/private
          name: proxy-tls
        - mountPath: /etc/tls/cookie-secret
          name: cookie-secret
      serviceAccountName: machine-config-controller
      nodeSelector:
        node-role.kubernetes.io/master: ""
      priorityClassName: "system-cluster-critical"
      volumes:
        - name: proxy-tls
          secret:
            secretName: mcc-proxy-tls
        - name: cookie-secret
          secret:
            secretName: cookie-secret
      restartPolicy: Always
      tolerations:
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: "NoSchedule"
      - key: "node.kubernetes.io/unreachable"
        operator: "Exists"
        effect: "NoExecute"
        tolerationSeconds: 120
      - key: "node.kubernetes.io/not-ready"
        operator: "Exists"
        effect: "NoExecute"
        tolerationSeconds: 120