apiVersion: apps/v1
kind: Deployment
metadata:
  name: grafana-operator
  namespace: grafana-operator
  labels:
    helm.sh/chart: grafana-operator-5.21.3
    app.kubernetes.io/name: grafana-operator
    app.kubernetes.io/instance: grafana-operator
    app.kubernetes.io/version: "v5.21.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: grafana-operator
    app.kubernetes.io/component: operator
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: grafana-operator
      app.kubernetes.io/instance: grafana-operator
  template:
    metadata:
      labels:
        helm.sh/chart: grafana-operator-5.21.3
        app.kubernetes.io/name: grafana-operator
        app.kubernetes.io/instance: grafana-operator
        app.kubernetes.io/version: "v5.21.3"
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/part-of: grafana-operator
        app.kubernetes.io/component: operator
    spec:
      serviceAccountName: grafana-operator
      containers:
        - name: grafana-operator
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
          image: "ghcr.io/grafana/grafana-operator:v5.21.3"
          imagePullPolicy: IfNotPresent
          env:
            - name: WATCH_NAMESPACE
              value:
            - name: WATCH_NAMESPACE_SELECTOR
              value: ""
            - name: WATCH_LABEL_SELECTORS
              value: ""
            - name: ENFORCE_CACHE_LABELS
              value: "safe"
            - name: CLUSTER_DOMAIN
              value: ""
          args:
            - --health-probe-bind-address=:8081
            - --metrics-bind-address=0.0.0.0:9090
            - --pprof-addr=0.0.0.0:8888
            - --zap-encoder=console
            - --zap-log-level=info
            - --zap-time-encoding=rfc3339
            - --default-resync-period=10m
            - --leader-elect
            - --max-concurrent-reconciles=1
          volumeMounts:
            - name: dashboards-dir
              mountPath: /tmp/dashboards
            - name: kubeauth-token-volume
              mountPath: /var/run/secrets/grafana.com/serviceaccount
              readOnly: true
          ports:
            - containerPort: 9090
              name: metrics
              protocol: TCP
            - containerPort: 8888
              name: pprof
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8081
          resources:
            requests:
              cpu: 10m
              memory: 64Mi
      volumes:
        - name: dashboards-dir
          emptyDir: {}
        - name: kubeauth-token-volume
          projected:
            sources:
              - serviceAccountToken:
                  audience: operator.grafana.com
                  expirationSeconds: 3600
                  path: token
