apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/component: manager
    app.kubernetes.io/created-by: spacelift-operator
    app.kubernetes.io/instance: system
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: namespace
    app.kubernetes.io/part-of: spacelift-operator
    control-plane: controller-manager
  name: spacelift-operator-system
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.16.5
  name: contexts.app.spacelift.io
spec:
  group: app.spacelift.io
  names:
    kind: Context
    listKind: ContextList
    plural: contexts
    singular: context
  scope: Namespaced
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: Context is the Schema for the contexts API
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: ContextSpec defines the desired state of Context
            properties:
              attachments:
                items:
                  properties:
                    moduleId:
                      minLength: 1
                      type: string
                    priority:
                      type: integer
                    stackId:
                      minLength: 1
                      type: string
                    stackName:
                      minLength: 1
                      type: string
                  type: object
                  x-kubernetes-validations:
                  - message: only one of stackName or stackId or moduleId should be
                      set
                    rule: has(self.stackName) != has(self.stackId) != has(self.moduleId)
                type: array
              description:
                type: string
              environment:
                items:
                  properties:
                    description:
                      type: string
                    id:
                      minLength: 1
                      pattern: ^[a-zA-Z_]+[a-zA-Z0-9_]*$
                      type: string
                    secret:
                      type: boolean
                    value:
                      type: string
                    valueFromSecret:
                      description: SecretKeySelector selects a key of a Secret.
                      properties:
                        key:
                          description: The key of the secret to select from.  Must
                            be a valid secret key.
                          type: string
                        name:
                          default: ""
                          description: |-
                            Name of the referent.
                            This field is effectively required, but due to backwards compatibility is
                            allowed to be empty. Instances of this type with an empty value here are
                            almost certainly wrong.
                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                          type: string
                        optional:
                          description: Specify whether the Secret or its key must
                            be defined
                          type: boolean
                      required:
                      - key
                      type: object
                      x-kubernetes-map-type: atomic
                  required:
                  - id
                  type: object
                  x-kubernetes-validations:
                  - message: only one of value or valueFromSecret should be set
                    rule: has(self.valueFromSecret) != has(self.value)
                type: array
              hooks:
                properties:
                  afterApply:
                    items:
                      type: string
                    type: array
                  afterDestroy:
                    items:
                      type: string
                    type: array
                  afterInit:
                    items:
                      type: string
                    type: array
                  afterPerform:
                    items:
                      type: string
                    type: array
                  afterPlan:
                    items:
                      type: string
                    type: array
                  afterRun:
                    items:
                      type: string
                    type: array
                  beforeApply:
                    items:
                      type: string
                    type: array
                  beforeDestroy:
                    items:
                      type: string
                    type: array
                  beforeInit:
                    items:
                      type: string
                    type: array
                  beforePerform:
                    items:
                      type: string
                    type: array
                  beforePlan:
                    items:
                      type: string
                    type: array
                type: object
              labels:
                items:
                  type: string
                type: array
              mountedFiles:
                items:
                  properties:
                    description:
                      type: string
                    id:
                      minLength: 1
                      type: string
                    secret:
                      type: boolean
                    value:
                      type: string
                    valueFromSecret:
                      description: SecretKeySelector selects a key of a Secret.
                      properties:
                        key:
                          description: The key of the secret to select from.  Must
                            be a valid secret key.
                          type: string
                        name:
                          default: ""
                          description: |-
                            Name of the referent.
                            This field is effectively required, but due to backwards compatibility is
                            allowed to be empty. Instances of this type with an empty value here are
                            almost certainly wrong.
                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                          type: string
                        optional:
                          description: Specify whether the Secret or its key must
                            be defined
                          type: boolean
                      required:
                      - key
                      type: object
                      x-kubernetes-map-type: atomic
                  required:
                  - id
                  type: object
                  x-kubernetes-validations:
                  - message: only one of value or valueFromSecret should be set
                    rule: has(self.valueFromSecret) != has(self.value)
                type: array
              name:
                type: string
              spaceId:
                minLength: 1
                type: string
              spaceName:
                minLength: 1
                type: string
            type: object
            x-kubernetes-validations:
            - message: only one of spaceName or spaceId should be set
              rule: has(self.spaceId) != has(self.spaceName)
          status:
            description: ContextStatus defines the observed state of Context
            properties:
              id:
                type: string
            required:
            - id
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.16.5
  name: policies.app.spacelift.io
spec:
  group: app.spacelift.io
  names:
    kind: Policy
    listKind: PolicyList
    plural: policies
    singular: policy
  scope: Namespaced
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: Policy is the Schema for the policies API
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: PolicySpec defines the desired state of Policy
            properties:
              attachedStacksIds:
                items:
                  type: string
                type: array
              attachedStacksNames:
                items:
                  type: string
                type: array
              body:
                description: Body of the policy
                minLength: 1
                type: string
              description:
                description: Description of the policy
                type: string
              labels:
                items:
                  type: string
                type: array
              name:
                description: Name of the policy - should be unique in one account
                type: string
              spaceId:
                description: SpaceId is ID (slug) of the space the policy is in
                type: string
              spaceName:
                description: SpaceName is Name of a Space kubernetes resource of the
                  space the policy is in
                type: string
              type:
                description: |-
                  Type of the policy. Possible values are ACCESS, APPROVAL, GIT_PUSH, INITIALIZATION, LOGIN, PLAN, TASK, TRIGGER and NOTIFICATION.
                  Deprecated values are STACK_ACCESS (use ACCESS instead), TASK_RUN (use TASK instead), and TERRAFORM_PLAN (use PLAN instead).
                enum:
                - ACCESS
                - APPROVAL
                - GIT_PUSH
                - INITIALIZATION
                - LOGIN
                - PLAN
                - TASK
                - TRIGGER
                - NOTIFICATION
                type: string
            required:
            - body
            - type
            type: object
            x-kubernetes-validations:
            - message: only one of spaceName or spaceId can be set
              rule: (has(self.spaceName) != has(self.spaceId)) || (!has(self.spaceName)
                && !has(self.spaceId))
          status:
            description: PolicyStatus defines the observed state of Policy
            properties:
              id:
                type: string
            required:
            - id
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.16.5
  name: runs.app.spacelift.io
spec:
  group: app.spacelift.io
  names:
    kind: Run
    listKind: RunList
    plural: runs
    singular: run
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.state
      name: State
      type: string
    - jsonPath: .status.id
      name: Id
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: Run is the Schema for the runs API
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: RunSpec defines the desired state of Run
            properties:
              createSecretFromStackOutput:
                type: boolean
              stackName:
                description: StackName is the name of the stack for this run, this
                  is mandatory
                minLength: 1
                type: string
            required:
            - stackName
            type: object
          status:
            description: RunStatus defines the observed state of Run
            properties:
              id:
                description: Id is the run ULID on Spacelift
                type: string
              stackId:
                type: string
              state:
                description: State is the run state, see RunState for all possibles
                  state of a run
                type: string
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.16.5
  name: spaces.app.spacelift.io
spec:
  group: app.spacelift.io
  names:
    kind: Space
    listKind: SpaceList
    plural: spaces
    singular: space
  scope: Namespaced
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: Space is the Schema for the Spaces API
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: SpaceSpec defines the desired state of space
            properties:
              description:
                type: string
              inheritEntities:
                type: boolean
              labels:
                items:
                  type: string
                type: array
              name:
                type: string
              parentSpace:
                minLength: 1
                type: string
            required:
            - parentSpace
            type: object
          status:
            properties:
              id:
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.16.5
  name: stacks.app.spacelift.io
spec:
  group: app.spacelift.io
  names:
    kind: Stack
    listKind: StackList
    plural: stacks
    singular: stack
  scope: Namespaced
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: Stack is the Schema for the stacks API
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: StackSpec defines the desired state of Stack
            properties:
              additionalProjectGlobs:
                items:
                  type: string
                type: array
              administrative:
                type: boolean
              afterApply:
                items:
                  type: string
                type: array
              afterDestroy:
                items:
                  type: string
                type: array
              afterInit:
                items:
                  type: string
                type: array
              afterPerform:
                items:
                  type: string
                type: array
              afterPlan:
                items:
                  type: string
                type: array
              afterRun:
                items:
                  type: string
                type: array
              autodeploy:
                type: boolean
              autoretry:
                type: boolean
              awsIntegration:
                properties:
                  id:
                    type: string
                  read:
                    type: boolean
                  write:
                    type: boolean
                required:
                - id
                - read
                - write
                type: object
              beforeApply:
                items:
                  type: string
                type: array
              beforeDestroy:
                items:
                  type: string
                type: array
              beforeInit:
                items:
                  type: string
                type: array
              beforePerform:
                items:
                  type: string
                type: array
              beforePlan:
                items:
                  type: string
                type: array
              branch:
                type: string
              commitSHA:
                minLength: 1
                type: string
              description:
                type: string
              githubActionDeploy:
                type: boolean
              isDisabled:
                type: boolean
              labels:
                items:
                  type: string
                type: array
              localPreviewEnabled:
                type: boolean
              managesStateFile:
                description: In our API managesStateFile is not part of StackInput
                type: boolean
              name:
                type: string
              projectRoot:
                type: string
              protectFromDeletion:
                type: boolean
              provider:
                type: string
              repository:
                type: string
              repositoryURL:
                type: string
              runnerImage:
                type: string
              spaceId:
                type: string
              spaceName:
                type: string
              terraformVersion:
                type: string
              vcsIntegrationId:
                type: string
              vendorConfig:
                properties:
                  ansible:
                    properties:
                      playbook:
                        type: string
                    required:
                    - playbook
                    type: object
                  cloudFormation:
                    properties:
                      entryTemplateFile:
                        type: string
                      region:
                        type: string
                      stackName:
                        type: string
                      templateBucket:
                        type: string
                    required:
                    - entryTemplateFile
                    - region
                    - stackName
                    - templateBucket
                    type: object
                  kubernetes:
                    properties:
                      kubectlVersion:
                        type: string
                      namespace:
                        type: string
                    required:
                    - namespace
                    type: object
                  pulumi:
                    properties:
                      loginURL:
                        type: string
                      stackName:
                        type: string
                    required:
                    - loginURL
                    - stackName
                    type: object
                  terraform:
                    properties:
                      externalStateAccessEnabled:
                        type: boolean
                      useSmartSanitization:
                        type: boolean
                      version:
                        type: string
                      workflowTool:
                        type: string
                      workspace:
                        type: string
                    type: object
                  terragrunt:
                    properties:
                      terraformVersion:
                        type: string
                      terragruntVersion:
                        type: string
                      useRunAll:
                        type: boolean
                      useSmartSanitization:
                        type: boolean
                    required:
                    - terraformVersion
                    - terragruntVersion
                    - useRunAll
                    - useSmartSanitization
                    type: object
                type: object
              workerPool:
                type: string
            required:
            - repository
            type: object
            x-kubernetes-validations:
            - message: only one of spaceName or spaceId can be set
              rule: has(self.spaceName) != has(self.spaceId)
          status:
            description: StackStatus defines the observed state of Stack
            properties:
              id:
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: rbac
    app.kubernetes.io/created-by: spacelift-operator
    app.kubernetes.io/instance: controller-manager-sa
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: serviceaccount
    app.kubernetes.io/part-of: spacelift-operator
  name: spacelift-operator-controller-manager
  namespace: spacelift-operator-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/component: rbac
    app.kubernetes.io/created-by: spacelift-operator
    app.kubernetes.io/instance: leader-election-role
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: role
    app.kubernetes.io/part-of: spacelift-operator
  name: spacelift-operator-leader-election-role
  namespace: spacelift-operator-system
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: spacelift-operator-manager-role
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - app.spacelift.io
  resources:
  - contexts
  - policies
  - runs
  - spaces
  - stacks
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - app.spacelift.io
  resources:
  - contexts/finalizers
  - policies/finalizers
  - runs/finalizers
  - spaces/finalizers
  - stacks/finalizers
  verbs:
  - update
- apiGroups:
  - app.spacelift.io
  resources:
  - contexts/status
  - policies/status
  - runs/status
  - spaces/status
  - stacks/status
  verbs:
  - get
  - patch
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/component: kube-rbac-proxy
    app.kubernetes.io/created-by: spacelift-operator
    app.kubernetes.io/instance: metrics-reader
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: clusterrole
    app.kubernetes.io/part-of: spacelift-operator
  name: spacelift-operator-metrics-reader
rules:
- nonResourceURLs:
  - /metrics
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/component: kube-rbac-proxy
    app.kubernetes.io/created-by: spacelift-operator
    app.kubernetes.io/instance: proxy-role
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: clusterrole
    app.kubernetes.io/part-of: spacelift-operator
  name: spacelift-operator-proxy-role
rules:
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: rbac
    app.kubernetes.io/created-by: spacelift-operator
    app.kubernetes.io/instance: leader-election-rolebinding
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: rolebinding
    app.kubernetes.io/part-of: spacelift-operator
  name: spacelift-operator-leader-election-rolebinding
  namespace: spacelift-operator-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: spacelift-operator-leader-election-role
subjects:
- kind: ServiceAccount
  name: spacelift-operator-controller-manager
  namespace: spacelift-operator-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/component: rbac
    app.kubernetes.io/created-by: spacelift-operator
    app.kubernetes.io/instance: manager-rolebinding
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: clusterrolebinding
    app.kubernetes.io/part-of: spacelift-operator
  name: spacelift-operator-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: spacelift-operator-manager-role
subjects:
- kind: ServiceAccount
  name: spacelift-operator-controller-manager
  namespace: spacelift-operator-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/component: kube-rbac-proxy
    app.kubernetes.io/created-by: spacelift-operator
    app.kubernetes.io/instance: proxy-rolebinding
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: clusterrolebinding
    app.kubernetes.io/part-of: spacelift-operator
  name: spacelift-operator-proxy-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: spacelift-operator-proxy-role
subjects:
- kind: ServiceAccount
  name: spacelift-operator-controller-manager
  namespace: spacelift-operator-system
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: kube-rbac-proxy
    app.kubernetes.io/created-by: spacelift-operator
    app.kubernetes.io/instance: controller-manager-metrics-service
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: service
    app.kubernetes.io/part-of: spacelift-operator
    control-plane: controller-manager
  name: spacelift-operator-controller-manager-metrics-service
  namespace: spacelift-operator-system
spec:
  ports:
  - name: https
    port: 8443
    protocol: TCP
    targetPort: https
  selector:
    control-plane: controller-manager
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: manager
    app.kubernetes.io/created-by: spacelift-operator
    app.kubernetes.io/instance: controller-manager
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: deployment
    app.kubernetes.io/part-of: spacelift-operator
    control-plane: controller-manager
  name: spacelift-operator-controller-manager
  namespace: spacelift-operator-system
spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: controller-manager
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: manager
      labels:
        control-plane: controller-manager
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/arch
                operator: In
                values:
                - amd64
                - arm64
              - key: kubernetes.io/os
                operator: In
                values:
                - linux
      containers:
      - args:
        - --secure-listen-address=0.0.0.0:8443
        - --upstream=http://127.0.0.1:8080/
        - --logtostderr=true
        - --v=0
        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
        name: kube-rbac-proxy
        ports:
        - containerPort: 8443
          name: https
          protocol: TCP
        resources:
          limits:
            cpu: 500m
            memory: 128Mi
          requests:
            cpu: 5m
            memory: 64Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
      - args:
        - --health-probe-bind-address=:8081
        - --metrics-bind-address=127.0.0.1:8080
        - --leader-elect
        command:
        - /spacelift-operator
        image: public.ecr.aws/spacelift/spacelift-operator:v0.2.0
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 15
          periodSeconds: 20
        name: manager
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        resources:
          limits:
            memory: 128Mi
          requests:
            cpu: 100m
            memory: 128Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: spacelift-operator-controller-manager
      terminationGracePeriodSeconds: 10
