---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: flux-helm-operator
spec:
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        name: flux-helm-operator
    spec:
      serviceAccount: flux
      volumes:
      - name: git-key
        secret:
          secretName: flux-git-deploy
      containers:
      - name: flux-helm-operator
        # There are no ":latest" images for helm-operator. Find the most recent
        # release or image version at https://quay.io/weaveworks/helm-operator
        # and replace the tag here.
        image: quay.io/weaveworks/helm-operator:alpha
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - name: git-key
          mountPath: /etc/fluxd/ssh
        args:
        # replace (at least) the following URL
        - --git-url=git@github.com:weaveworks/flux-helm-test
        - --git-branch=master
        - --git-charts-path=charts

---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: flux-helm-operator
spec:
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        name: flux-helm-operator
    spec:
      serviceAccount: flux
      volumes:
      - name: git-key
        secret:
          secretName: flux-git-deploy
          defaultMode: 0400 # when mounted read-only, we won't be able to chmod
      containers:
      - name: flux-helm-operator
        # There are no ":latest" images for helm-operator. Find the most recent
        # release or image version at https://quay.io/weaveworks/helm-operator
        # and replace the tag here.
        image: quay.io/weaveworks/helm-operator:alpha
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - name: git-key
          mountPath: /etc/fluxd/ssh
          readOnly: true # this will be the case perforce in K8s >=1.10
        args:
        # replace (at least) the following URL
        - --git-url=git@github.com:weaveworks/flux-helm-test
        - --git-branch=master
        - --git-charts-path=charts

Make mode of ssh identity files RO
Make mode of ssh identity files RO

This causes flux-helm-operator not to try to chmod them to this mode,
which in kubernetes 1.9.4+ and 1.10+, breaks, as secrets volumes are now
read-only filesystems, to mitigate CVE-2017-1002102. This effectively
reapplied the same fix to the main fluxd deployment.
