{#
Copyright 2019 Nokia

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
#}
---
apiVersion: v1
kind: Pod
metadata:
  name: kube-controller-manager
  namespace: kube-system
spec:
  hostNetwork: true
  dnsPolicy: ClusterFirst
  containers:
    - name: kube-controller-manager
      image: {{ container_image_names | select('search', '/hyperkube') | list | last }}
      securityContext:
        runAsUser: {{ caas.uid.kube }}
      command:
        - "/kube-controller-manager"
        - "--feature-gates={{ controllermanager_feature_gates | get_kube_options }}"
        - "--horizontal-pod-autoscaler-use-rest-clients=true"
        - "--kubeconfig=/etc/kubernetes/kubeconfig/cmc.yml"
        - "--service-account-private-key-file=/etc/kubernetes/ssl/service-account-key.pem"
        - "--root-ca-file=/etc/openssl/ca.pem"
        - "{% if groups['caas_master']|length|int > 1 %}--leader-elect=true{% endif %}"
        - "--cluster-cidr={{ caas.oam_cidr }}"
        - "--use-service-account-credentials=true"
        - "--allocate-node-cidrs=true"
        - "--cluster-signing-cert-file=/etc/openssl/ca.pem"
        - "--cluster-signing-key-file=/etc/openssl/ca-key.pem"
      livenessProbe:
        httpGet:
          host: 127.0.0.1
          path: /healthz
          port: 10252
        initialDelaySeconds: 15
        timeoutSeconds: 1
      resources:
        requests:
          cpu: "10m"
      volumeMounts:
        - name: time-mount
          mountPath: /etc/localtime
          readOnly: true
        - name: secret-kubernetes
          mountPath: /etc/kubernetes/ssl
          readOnly: true
        - name: secret-root-ca
          mountPath: /etc/openssl/ca.pem
          readOnly: true
        - name: secret-root-ca-key
          mountPath: /etc/openssl/ca-key.pem
          readOnly: true
        - name: kubeconfig
          mountPath: /etc/kubernetes/kubeconfig
          readOnly: true
  volumes:
    - name: time-mount
      hostPath:
        path: /etc/localtime
    - name: secret-kubernetes
      hostPath:
        path: /etc/kubernetes/ssl
    - name: secret-root-ca
      hostPath:
        path: /etc/openssl/ca.pem
    - name: secret-root-ca-key
      hostPath:
        path: /etc/openssl/ca-key.pem
    - name: kubeconfig
      hostPath:
        path: /etc/kubernetes/kubeconfig