apiVersion: v1
kind: Namespace
metadata:
  name: pinitctl
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: pinitctl
  namespace: pinitctl
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: pinitctl
  namespace: pinitctl
spec:
  replicas: 1
  selector:
    matchLabels:
      platform.edge.ncr.com/component: pinitctl
  template:
    metadata:
      labels:
        platform.edge.ncr.com/component: pinitctl
    spec:
      serviceAccountName: pinitctl
      containers:
      - name: pinitctl
        image: bzl://cmd/f8n/pinitctl:container_push
        envFrom:
        - configMapRef:
            name: pinitctl
        # merged with existing keys, can be used to pass optional config
        - configMapRef:
            name: pinitctl-options
            optional: true
        env:
        - name: RUNTIME_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        resources:
          limits:
            cpu: "100m"
        imagePullPolicy: IfNotPresent
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: pinitctl
roleRef:
  name: pinitctl
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
subjects:
- name: pinitctl
  namespace: pinitctl
  kind: ServiceAccount