apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: argocd-applicationset-controller
    app.kubernetes.io/part-of: argocd-applicationset
    app.kubernetes.io/component: controller
  name: argocd-applicationset-controller
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: argocd-applicationset-controller
  template:
    metadata:
      labels:
        app.kubernetes.io/name: argocd-applicationset-controller
    spec:
      containers:
        - command:
            - entrypoint.sh
            - argocd-applicationset-controller
          image: quay.io/argoproj/argocd:latest
          imagePullPolicy: Always
          name: argocd-applicationset-controller
          ports:
          - containerPort: 7000
            name: webhook
          - containerPort: 8080
            name: metrics
          env:
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          volumeMounts:
          - mountPath: /app/config/ssh
            name: ssh-known-hosts
          - mountPath: /app/config/tls
            name: tls-certs
          - mountPath: /app/config/gpg/source
            name: gpg-keys
          - mountPath: /app/config/gpg/keys
            name: gpg-keyring
          - mountPath: /tmp
            name: tmp
          securityContext:
            capabilities:
              drop:
              - ALL
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true 
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
      serviceAccountName: argocd-applicationset-controller
      volumes:
      - configMap:
          name: argocd-ssh-known-hosts-cm
        name: ssh-known-hosts
      - configMap:
          name: argocd-tls-certs-cm
        name: tls-certs
      - configMap:
          name: argocd-gpg-keys-cm
        name: gpg-keys
      - emptyDir: {}
        name: gpg-keyring
      - emptyDir: {}
        name: tmp