|
| 1 | +apiVersion: apps/v1 |
| 2 | +kind: Deployment |
| 3 | +metadata: |
| 4 | + name: cluster-version-operator |
| 5 | + namespace: openshift-cluster-version |
| 6 | + annotations: |
| 7 | + kubernetes.io/description: The cluster-version operator manages OpenShift updates and reconciles core resources and cluster operators. |
| 8 | + exclude.release.openshift.io/internal-openshift-hosted: "true" |
| 9 | + include.release.openshift.io/self-managed-high-availability: "true" |
| 10 | +spec: |
| 11 | + selector: |
| 12 | + matchLabels: |
| 13 | + k8s-app: cluster-version-operator |
| 14 | + strategy: |
| 15 | + type: Recreate |
| 16 | + template: |
| 17 | + metadata: |
| 18 | + name: cluster-version-operator |
| 19 | + annotations: |
| 20 | + target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' |
| 21 | + openshift.io/required-scc: hostaccess |
| 22 | + labels: |
| 23 | + k8s-app: cluster-version-operator |
| 24 | + spec: |
| 25 | + automountServiceAccountToken: false |
| 26 | + containers: |
| 27 | + - name: cluster-version-operator |
| 28 | + image: quay.io/cvo/release:latest |
| 29 | + imagePullPolicy: IfNotPresent |
| 30 | + args: |
| 31 | + - "start" |
| 32 | + - "--release-image=quay.io/cvo/release:latest" |
| 33 | + - "--enable-auto-update=false" |
| 34 | + - "--listen=0.0.0.0:9099" |
| 35 | + - "--serving-cert-file=/etc/tls/serving-cert/tls.crt" |
| 36 | + - "--serving-key-file=/etc/tls/serving-cert/tls.key" |
| 37 | + - "--v=2" |
| 38 | + - "--always-enable-capabilities=Ingress" |
| 39 | + resources: |
| 40 | + requests: |
| 41 | + cpu: 20m |
| 42 | + memory: 50Mi |
| 43 | + terminationMessagePolicy: FallbackToLogsOnError |
| 44 | + volumeMounts: |
| 45 | + - mountPath: /etc/ssl/certs |
| 46 | + name: etc-ssl-certs |
| 47 | + readOnly: true |
| 48 | + - mountPath: /etc/cvo/updatepayloads |
| 49 | + name: etc-cvo-updatepayloads |
| 50 | + readOnly: true |
| 51 | + - mountPath: /etc/tls/serving-cert |
| 52 | + name: serving-cert |
| 53 | + readOnly: true |
| 54 | + - mountPath: /etc/tls/service-ca |
| 55 | + name: service-ca |
| 56 | + readOnly: true |
| 57 | + - mountPath: /var/run/secrets/kubernetes.io/serviceaccount |
| 58 | + name: kube-api-access |
| 59 | + readOnly: true |
| 60 | + env: |
| 61 | + # Unfortunately the placeholder is not replaced, reported as OCPBUGS-30080 |
| 62 | + - name: OPERATOR_IMAGE_VERSION |
| 63 | + value: "0.0.1-snapshot" |
| 64 | + - name: KUBERNETES_SERVICE_PORT # allows CVO to communicate with apiserver directly on same host. Is substituted with port from infrastructures.status.apiServerInternalURL if available. |
| 65 | + value: "6443" |
| 66 | + - name: KUBERNETES_SERVICE_HOST # allows CVO to communicate with apiserver directly on same host. Is substituted with hostname from infrastructures.status.apiServerInternalURL if available. |
| 67 | + value: "127.0.0.1" |
| 68 | + - name: NODE_NAME |
| 69 | + valueFrom: |
| 70 | + fieldRef: |
| 71 | + fieldPath: spec.nodeName |
| 72 | + - name: CLUSTER_PROFILE |
| 73 | + value: some-profile |
| 74 | + # this pod is hostNetwork and uses the internal LB DNS name when possible, which the kubelet also uses. |
| 75 | + # this dnsPolicy allows us to use the same dnsConfig as the kubelet, without access to read it ourselves. |
| 76 | + dnsPolicy: Default |
| 77 | + hostNetwork: true |
| 78 | + nodeSelector: |
| 79 | + node-role.kubernetes.io/master: "" |
| 80 | + priorityClassName: "system-cluster-critical" |
| 81 | + terminationGracePeriodSeconds: 130 |
| 82 | + tolerations: |
| 83 | + - key: "node-role.kubernetes.io/master" |
| 84 | + operator: Exists |
| 85 | + effect: "NoSchedule" |
| 86 | + - key: "node.kubernetes.io/network-unavailable" |
| 87 | + operator: Exists |
| 88 | + effect: "NoSchedule" |
| 89 | + - key: "node.kubernetes.io/not-ready" |
| 90 | + operator: "Exists" |
| 91 | + effect: "NoSchedule" |
| 92 | + - key: "node.kubernetes.io/unreachable" |
| 93 | + operator: "Exists" |
| 94 | + effect: "NoExecute" |
| 95 | + tolerationSeconds: 120 |
| 96 | + - key: "node.kubernetes.io/not-ready" |
| 97 | + operator: "Exists" |
| 98 | + effect: "NoExecute" |
| 99 | + tolerationSeconds: 120 |
| 100 | + volumes: |
| 101 | + - name: etc-ssl-certs |
| 102 | + hostPath: |
| 103 | + path: /etc/ssl/certs |
| 104 | + - name: etc-cvo-updatepayloads |
| 105 | + hostPath: |
| 106 | + path: /etc/cvo/updatepayloads |
| 107 | + - name: serving-cert |
| 108 | + secret: |
| 109 | + secretName: cluster-version-operator-serving-cert |
| 110 | + - name: service-ca |
| 111 | + configMap: |
| 112 | + name: openshift-service-ca.crt |
| 113 | + - name: kube-api-access |
| 114 | + projected: |
| 115 | + defaultMode: 420 |
| 116 | + sources: |
| 117 | + - serviceAccountToken: |
| 118 | + expirationSeconds: 3600 |
| 119 | + path: token |
| 120 | + - configMap: |
| 121 | + items: |
| 122 | + - key: ca.crt |
| 123 | + path: ca.crt |
| 124 | + name: kube-root-ca.crt |
| 125 | + - downwardAPI: |
| 126 | + items: |
| 127 | + - fieldRef: |
| 128 | + apiVersion: v1 |
| 129 | + fieldPath: metadata.namespace |
| 130 | + path: namespace |
0 commit comments