apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: tectonic-channel-operator
  namespace: tectonic-system
  labels:
    k8s-app: tectonic-channel-operator
    managed-by-channel-operator: "true"
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: tectonic-channel-operator
  template:
    metadata:
      labels:
        k8s-app: tectonic-channel-operator
        tectonic-app-version-name: tectonic-cluster
    spec:
      containers:
      - name: tectonic-channel-operator
        image: ${tectonic_channel_operator_image}
        env:
          - name: CLUSTER_ID
            valueFrom:
              configMapKeyRef:
                name: tectonic-config
                key: clusterID
        resources:
          limits:
            cpu: 20m
            memory: 50Mi
          requests:
            cpu: 20m
            memory: 50Mi
        volumeMounts:
        - name: certs
          mountPath: /etc/ssl/certs
      restartPolicy: Always
      imagePullSecrets:
      - name: coreos-pull-secret
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
      volumes:
      - name: certs
        hostPath:
          path: /usr/share/ca-certificates

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: tectonic-channel-operator
  namespace: tectonic-system
  labels:
    k8s-app: tectonic-channel-operator
    managed-by-channel-operator: "true"
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: tectonic-channel-operator
  template:
    metadata:
      labels:
        k8s-app: tectonic-channel-operator
        tectonic-app-version-name: tectonic-cluster
    spec:
      nodeSelector:
        node-role.kubernetes.io/master: ""
      tolerations:
      - key: "node-role.kubernetes.io/master"
        operator: "Exists"
        effect: "NoSchedule"
      containers:
      - name: tectonic-channel-operator
        image: ${tectonic_channel_operator_image}
        env:
          - name: CLUSTER_ID
            valueFrom:
              configMapKeyRef:
                name: tectonic-config
                key: clusterID
        resources:
          limits:
            cpu: 20m
            memory: 50Mi
          requests:
            cpu: 20m
            memory: 50Mi
        volumeMounts:
        - name: certs
          mountPath: /etc/ssl/certs
      restartPolicy: Always
      imagePullSecrets:
      - name: coreos-pull-secret
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
      volumes:
      - name: certs
        hostPath:
          path: /usr/share/ca-certificates

Add toleration and node selector for tco to schedule it to master.
updater: Add toleration and node selector for tco to schedule it to master.

This is because tco replies on ssl certs path that doesn't exist on rhel nodes.
