################################
# Citadel with plug-in key/certs. Run this after istio-auth.yaml
################################
apiVersion: v1
kind: ServiceAccount
metadata:
  name: istio-citadel-service-account
  namespace: istio-system
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: istio-citadel
  namespace: istio-system
spec:
  replicas: 1
  template:
    metadata:
      labels:
        istio: citadel
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      serviceAccountName: istio-citadel-service-account
      containers:
      - name: citadel
        image: gcr.io/istio-release/citadel:1.1.0.snapshot.0
        imagePullPolicy: IfNotPresent
        command: ["/usr/local/bin/istio_ca"]
        args:
          - --append-dns-names=true
          - --citadel-storage-namespace=istio-system
          - --grpc-port=8060
          - --grpc-hostname=citadel
          - --self-signed-ca=false
          - --signing-cert=/etc/cacerts/ca-cert.pem
          - --signing-key=/etc/cacerts/ca-key.pem
          - --root-cert=/etc/cacerts/root-cert.pem
          - --cert-chain=/etc/cacerts/cert-chain.pem
        volumeMounts:
        - name: cacerts
          mountPath: /etc/cacerts
          readOnly: true
      volumes:
      - name: cacerts
        secret:
          secretName: cacerts
          optional: true
---
