cluster-version-operator/pkg/payload/testdata/TestRenderManifest_expected_cvo_deployment.yaml at da1be8c4b6203f1658ca62f1eb7749652fa12f44 · openshift/cluster-version-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cluster-version-operator
  namespace: openshift-cluster-version
  annotations:
    kubernetes.io/description: The cluster-version operator manages OpenShift updates and reconciles core resources and cluster operators.
    exclude.release.openshift.io/internal-openshift-hosted: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
spec:
  selector:
    matchLabels:
      k8s-app: cluster-version-operator
  strategy:
    type: Recreate
  template:
    metadata:
      name: cluster-version-operator
      annotations:
        target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        openshift.io/required-scc: hostaccess
      labels:
        k8s-app: cluster-version-operator
    spec:
      automountServiceAccountToken: false
      serviceAccountName: cluster-version-operator
      containers:
      - name: cluster-version-operator
        image: 'quay.io/cvo/release:latest'
        imagePullPolicy: IfNotPresent
        args:
        - "start"
        - "--release-image=quay.io/cvo/release:latest"
        - "--enable-auto-update=false"
        - "--listen=0.0.0.0:9099"
        - "--serving-cert-file=/etc/tls/serving-cert/tls.crt"
        - "--serving-key-file=/etc/tls/serving-cert/tls.key"
        - "--v=2"
        - "--always-enable-capabilities=Ingress"
        ports:
        - name: metrics
          containerPort: 9099
        resources:
          requests:
            cpu: 20m
            memory: 50Mi
        terminationMessagePolicy: FallbackToLogsOnError
        securityContext:
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /etc/ssl/certs
          name: etc-ssl-certs
          readOnly: true
        - mountPath: /etc/cvo/updatepayloads
          name: etc-cvo-updatepayloads
          readOnly: true
        - mountPath: /etc/tls/serving-cert
          name: serving-cert
          readOnly: true
        - mountPath: /etc/tls/service-ca
          name: service-ca
          readOnly: true
        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          name: kube-api-access
          readOnly: true
        env:
        # Unfortunately the placeholder is not replaced, reported as OCPBUGS-30080
        - name: OPERATOR_IMAGE_VERSION
          value: "0.0.1-snapshot"
        - name: KUBERNETES_SERVICE_PORT  # allows CVO to communicate with apiserver directly on same host.  Is substituted with port from infrastructures.status.apiServerInternalURL if available.
          value: "6443"
        - name: KUBERNETES_SERVICE_HOST  # allows CVO to communicate with apiserver directly on same host.  Is substituted with hostname from infrastructures.status.apiServerInternalURL if available.
          value: "127.0.0.1"
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: CLUSTER_PROFILE
          value: 'some-profile'
        - name: KUBE_FEATURE_WatchListClient
          value: "false"
      # this pod is hostNetwork and uses the internal LB DNS name when possible, which the kubelet also uses.
      # this dnsPolicy allows us to use the same dnsConfig as the kubelet, without access to read it ourselves.
      dnsPolicy: Default
      hostNetwork: true
      nodeSelector:
        node-role.kubernetes.io/master: ""
      priorityClassName: "system-cluster-critical"
      terminationGracePeriodSeconds: 130
      tolerations:
      - key: "node-role.kubernetes.io/master"
        operator: Exists
        effect: "NoSchedule"
      - key: "node.kubernetes.io/network-unavailable"
        operator: Exists
        effect: "NoSchedule"
      - key: "node.kubernetes.io/not-ready"
        operator: "Exists"
        effect: "NoSchedule"
      - key: "node.kubernetes.io/unreachable"
        operator: "Exists"
        effect: "NoExecute"
        tolerationSeconds: 120
      - key: "node.kubernetes.io/not-ready"
        operator: "Exists"
        effect: "NoExecute"
        tolerationSeconds: 120
      volumes:
      - name: etc-ssl-certs
        hostPath:
          path: /etc/ssl/certs
      - name: etc-cvo-updatepayloads
        hostPath:
          path: /etc/cvo/updatepayloads
      - name: serving-cert
        secret:
          secretName: cluster-version-operator-serving-cert
      - name: service-ca
        configMap:
          name: openshift-service-ca.crt
      - name: kube-api-access
        projected:
          defaultMode: 420
          sources:
          - serviceAccountToken:
              expirationSeconds: 3600
              path: token
          - configMap:
              items:
              - key: ca.crt
                path: ca.crt
              name: kube-root-ca.crt
          - downwardAPI:
              items:
              - fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
                path: namespace