20-deployment.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: clever-operator-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: clever-operator
  name: clever-operator
  namespace: clever-operator-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: clever-operator
  name: system:clever-operator
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  - events
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - api.clever-cloud.com
  resources:
  - pulsars
  - pulsars/status
  - mysqls
  - mysqls/status
  - postgresqls
  - postgresqls/status
  - redis
  - redis/status
  - mongodbs
  - mongodbs/status
  - elasticsearches
  - elasticsearches/status
  - configproviders
  - configproviders/status
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: clever-operator
  name: system:clever-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:clever-operator
subjects:
- kind: ServiceAccount
  name: clever-operator
  namespace: clever-operator-system
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: clever-operator
  namespace: clever-operator-system
spec:
  minAvailable: 0
  selector:
    matchLabels:
      app: clever-operator
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: clever-operator
  namespace: clever-operator-system
spec:
  podSelector:
    matchLabels:
      app: clever-operator
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - {}
  egress:
    - {}
---
apiVersion: v1
kind: Secret
metadata:
  namespace: clever-operator-system
  name: clever-operator-configuration
data:
  config.toml: W2FwaV0KdG9rZW4gPSAiIgpzZWNyZXQgPSAiIgpjb25zdW1lci1rZXkgPSAiIgpjb25zdW1lci1zZWNyZXQgPSAiIgo=
---
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: clever-operator-system
  name: clever-operator
  labels:
    app: clever-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      app: clever-operator
  template:
    metadata:
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '8000'
      labels:
        app: clever-operator
    spec:
      serviceAccountName: clever-operator
      automountServiceAccountToken: true
      volumes:
      - name: config
        secret:
          secretName: clever-operator-configuration
      containers:
        - image: clevercloud/clever-operator:ca53fedf01d1f813df6f061ef511b6e576084531
          imagePullPolicy: Always
          name: clever-operator
          command: ["/usr/local/bin/clever-operator"]
          args: ["-vvvvvvv"]
          volumeMounts:
          - name: config
            mountPath: "/etc/clever-operator"
            readOnly: true
          resources:
            requests:
              memory: 64M
              cpu: 100m
              ephemeral-storage: 128Mi
            limits:
              memory: 64M
              cpu: 100m
              ephemeral-storage: 128Mi
          ports:
            - containerPort: 8000
              protocol: TCP
              name: observability
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: observability
              scheme: HTTP
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 1
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            runAsNonRoot: true
            runAsGroup: 25000
            runAsUser: 20000
      restartPolicy: Always
      terminationGracePeriodSeconds: 30