deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: telemetry-metrics-collector
    app.kubernetes.io/managed-by: cluster-monitoring-operator
    app.kubernetes.io/name: telemeter-client
    app.kubernetes.io/part-of: openshift-monitoring
  name: telemeter-client
  namespace: openshift-monitoring
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: telemetry-metrics-collector
      app.kubernetes.io/name: telemeter-client
  template:
    metadata:
      annotations:
        openshift.io/required-scc: restricted-v2
        target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
      labels:
        app.kubernetes.io/component: telemetry-metrics-collector
        app.kubernetes.io/managed-by: cluster-monitoring-operator
        app.kubernetes.io/name: telemeter-client
        app.kubernetes.io/part-of: openshift-monitoring
    spec:
      containers:
      - command:
        - /usr/bin/telemeter-client
        - --id=$(ID)
        - --from=$(FROM)
        - --tls-cert-file=/etc/tls/private/tls.crt
        - --tls-private-key-file=/etc/tls/private/tls.key
        - --from-ca-file=/etc/serving-certs-ca-bundle/service-ca.crt
        - --from-token-file=/var/run/secrets/kubernetes.io/serviceaccount/token
        - --to=$(TO)
        - --to-token-file=/etc/telemeter/token
        - --listen=localhost:8080
        - --anonymize-salt-file=/etc/telemeter/salt
        - --anonymize-labels=$(ANONYMIZE_LABELS)
        env:
        - name: ANONYMIZE_LABELS
          value: ""
        - name: FROM
          value: https://prometheus-k8s.openshift-monitoring.svc:9091
        - name: ID
          value: ""
        - name: TO
          value: https://infogw.api.openshift.com
        - name: HTTP_PROXY
          value: ""
        - name: HTTPS_PROXY
          value: ""
        - name: NO_PROXY
          value: ""
        image: quay.io/openshift/origin-telemeter:v4.0
        name: telemeter-client
        ports:
        - containerPort: 8080
          name: http
        resources:
          requests:
            cpu: 1m
            memory: 40Mi
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /etc/serving-certs-ca-bundle
          name: serving-certs-ca-bundle
          readOnly: false
        - mountPath: /etc/telemeter
          name: secret-telemeter-client
          readOnly: false
        - mountPath: /etc/tls/private
          name: federate-client-tls
          readOnly: false
      - args:
        - --reload-url=http://localhost:8080/-/reload
        - --watched-dir=/etc/serving-certs-ca-bundle
        image: quay.io/openshift/origin-configmap-reload:v3.11
        name: reload
        resources:
          requests:
            cpu: 1m
            memory: 10Mi
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /etc/serving-certs-ca-bundle
          name: serving-certs-ca-bundle
          readOnly: false
      - args:
        - --secure-listen-address=:8443
        - --upstream=http://127.0.0.1:8080/
        - --tls-cert-file=/etc/tls/private/tls.crt
        - --tls-private-key-file=/etc/tls/private/tls.key
        - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        - --config-file=/etc/kube-rbac-policy/config.yaml
        - --client-ca-file=/etc/tls/client/client-ca.crt
        image: quay.io/brancz/kube-rbac-proxy:v0.18.2
        name: kube-rbac-proxy
        ports:
        - containerPort: 8443
          name: https
        resources:
          requests:
            cpu: 1m
            memory: 20Mi
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /etc/tls/private
          name: telemeter-client-tls
          readOnly: false
        - mountPath: /etc/kube-rbac-policy
          name: secret-telemeter-client-kube-rbac-proxy-config
          readOnly: true
        - mountPath: /etc/tls/client
          name: metrics-client-ca
          readOnly: true
      nodeSelector:
        kubernetes.io/os: linux
      priorityClassName: system-cluster-critical
      serviceAccountName: telemeter-client
      volumes:
      - configMap:
          name: telemeter-client-serving-certs-ca-bundle
        name: serving-certs-ca-bundle
      - name: secret-telemeter-client
        secret:
          secretName: telemeter-client
      - name: telemeter-client-tls
        secret:
          secretName: telemeter-client-tls
      - name: federate-client-tls
        secret:
          secretName: federate-client-certs
      - name: secret-telemeter-client-kube-rbac-proxy-config
        secret:
          secretName: telemeter-client-kube-rbac-proxy-config
      - configMap:
          name: metrics-client-ca
        name: metrics-client-ca