{{- if .Values.rbacManager.deploy }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "name" . }}-rbac-manager
  labels:
    app: {{ template "name" . }}-rbac-manager
    chart: {{ template "chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  replicas: {{ .Values.replicas }}
  selector:
    matchLabels:
      app: {{ template "name" . }}-rbac-manager
      release: {{ .Release.Name }}
  strategy:
    type: {{ .Values.deploymentStrategy }}
  template:
    metadata:
      labels:
        app: {{ template "name" . }}-rbac-manager
        release: {{ .Release.Name }}
    spec:
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName | quote }}
      {{- end }}
      serviceAccountName: rbac-manager
      containers:
      - image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
        args:
        - rbac
        {{- if .Values.rbacManager.managementPolicy }}
        - --manage={{ .Values.rbacManager.managementPolicy }}
        {{- end }}
        {{- range $arg := .Values.rbacManager.args }}
        - {{ $arg }}
        {{- end }}
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        name: {{ .Chart.Name }}
        resources:
          {{- toYaml .Values.resourcesRBACManager | nindent 12 }}
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
{{- end}}
