---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/instance: kueue
    app.kubernetes.io/name: kueue
    app.kubernetes.io/version: v0.12.3
    control-plane: controller-manager
  name: kueue-controller-manager
  namespace: kueue-system
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/instance: kueue
      app.kubernetes.io/name: kueue
      control-plane: controller-manager
  template:
    metadata:
      annotations:
        charts.kueue.x-k8s.io/config-checksum: 8b389750af0aa41518832334ac53b32dccd3eea657d6f2695a3d6ff714c696fc
        kubectl.kubernetes.io/default-container: manager
      labels:
        app.kubernetes.io/instance: kueue
        app.kubernetes.io/name: kueue
        control-plane: controller-manager
    spec:
      containers:
        - args:
            - --config=/controller_manager_config.yaml
            - --zap-log-level=2
          command:
            - /manager
          image: registry.k8s.io/kueue/kueue@sha256:a1d003837ea0b12f6a952bf02ea9948a2659749e0955f1f1d659ff53bdbd11e7 # Original tag: v0.12.3
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 15
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 1
          name: manager
          ports:
            - containerPort: 8082
              name: visibility
              protocol: TCP
            - containerPort: 9443
              name: webhook-server
              protocol: TCP
            - containerPort: 8443
              name: metrics
              protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /readyz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            limits:
              cpu: "2"
              memory: 512Mi
            requests:
              cpu: 500m
              memory: 512Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
          volumeMounts:
            - mountPath: /tmp/k8s-webhook-server/serving-certs
              name: cert
              readOnly: true
            - mountPath: /visibility
              name: visibility
            - mountPath: /controller_manager_config.yaml
              name: manager-config
              subPath: controller_manager_config.yaml
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: kueue-controller-manager
      terminationGracePeriodSeconds: 10
      volumes:
        - name: cert
          secret:
            defaultMode: 420
            secretName: kueue-webhook-server-cert
        - configMap:
            name: kueue-manager-config
          name: manager-config
        - emptyDir: {}
          name: visibility