apiVersion: v1
kind: ServiceAccount
metadata:
  name: reloader
  namespace: devops

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: reloader-role
  namespace: devops
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
      - configmaps
    verbs:
      - list
      - get
      - watch
  - apiGroups:
      - "apps"
    resources:
      - deployments
      - daemonsets
      - statefulsets
    verbs:
      - list
      - get
      - update
      - patch
  - apiGroups:
      - "extensions"
    resources:
      - deployments
      - daemonsets
    verbs:
      - list
      - get
      - update
      - patch

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: reloader-role-binding
  namespace: devops
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: reloader-role
subjects:
  - kind: ServiceAccount
    name: reloader
    namespace: devops

---

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: reloader
  name: reloader
  namespace: devops
spec:
  replicas: 1
  revisionHistoryLimit: 1
  selector:
    matchLabels:
      app: reloader
  template:
    metadata:
      labels:
        app: reloader
    spec:
      containers:
      - image: stakater/reloader:v0.0.110
        imagePullPolicy: IfNotPresent
        name: reloader
        ports:
        - name: http
          containerPort: 9090
        livenessProbe:
          httpGet:
            path: /metrics
            port: http
          timeoutSeconds: 5
          failureThreshold: 5
          periodSeconds: 10
          successThreshold: 1
        readinessProbe:
          httpGet:
            path: /metrics
            port: http
          timeoutSeconds: 5
          failureThreshold: 5
          periodSeconds: 10
          successThreshold: 1
      securityContext: 
        runAsNonRoot: true
        runAsUser: 65534
      serviceAccountName: reloader