# istio CA watching all namespaces
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: istio-citadel
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ template "security.name" . }}
    istio: citadel
    {{- template "common_labels" . }}
spec:
  replicas: {{ .Values.replicaCount }}
  template:
    metadata:
      labels:
        istio: citadel
      annotations:
        sidecar.istio.io/inject: "false"
        scheduler.alpha.kubernetes.io/critical-pod: ""
    spec:
      serviceAccountName: istio-citadel-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: citadel
          image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"
          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
          args:
            - --append-dns-names=true
            - --grpc-port=8060
            - --grpc-hostname=citadel
            - --citadel-storage-namespace={{ .Release.Namespace }}
          {{- if .Values.selfSigned }}
            - --self-signed-ca=true
          {{- else }}
            - --self-signed-ca=false
            - --signing-cert=/etc/cacerts/ca-cert.pem
            - --signing-key=/etc/cacerts/ca-key.pem
            - --root-cert=/etc/cacerts/root-cert.pem
            - --cert-chain=/etc/cacerts/cert-chain.pem
          {{- end }}
          resources:
{{- if .Values.resources }}
{{ toYaml .Values.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
{{- if not .Values.selfSigned }}
          volumeMounts:
          - name: cacerts
            mountPath: /etc/cacerts
            readOnly: true
      volumes:
      - name: cacerts
        secret:
         secretName: cacerts
         optional: true
{{- end }}
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
