# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: Namespace
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
    iam.gke.io/gcp-service-account: NAME-cnrm-system@PROJECT.iam.gserviceaccount.com # {"$kpt-set":"cnrm-system"}
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-controller-manager
  namespace: cnrm-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-deletiondefender
  namespace: cnrm-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-resource-stats-recorder
  namespace: cnrm-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-webhook-manager
  namespace: cnrm-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-deletiondefender-cnrm-system-role
  namespace: cnrm-system
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - create
  - update
  - patch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-webhook-cnrm-system-role
  namespace: cnrm-system
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - create
  - update
  - patch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-admin
rules:
- apiGroups:
  - accesscontextmanager.cnrm.cloud.google.com
  - artifactregistry.cnrm.cloud.google.com
  - bigquery.cnrm.cloud.google.com
  - bigtable.cnrm.cloud.google.com
  - cloudbuild.cnrm.cloud.google.com
  - compute.cnrm.cloud.google.com
  - container.cnrm.cloud.google.com
  - dataflow.cnrm.cloud.google.com
  - dns.cnrm.cloud.google.com
  - firestore.cnrm.cloud.google.com
  - iam.cnrm.cloud.google.com
  - kms.cnrm.cloud.google.com
  - logging.cnrm.cloud.google.com
  - monitoring.cnrm.cloud.google.com
  - pubsub.cnrm.cloud.google.com
  - redis.cnrm.cloud.google.com
  - resourcemanager.cnrm.cloud.google.com
  - secretmanager.cnrm.cloud.google.com
  - servicenetworking.cnrm.cloud.google.com
  - serviceusage.cnrm.cloud.google.com
  - sourcerepo.cnrm.cloud.google.com
  - spanner.cnrm.cloud.google.com
  - sql.cnrm.cloud.google.com
  - storage.cnrm.cloud.google.com
  - storagetransfer.cnrm.cloud.google.com
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-deletiondefender-role
rules:
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - validatingwebhookconfigurations
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-manager-cluster-role
rules:
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - validatingwebhookconfigurations
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - core.cnrm.cloud.google.com
  resources:
  - servicemappings
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - core.cnrm.cloud.google.com
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-manager-ns-role
rules:
- apiGroups:
  - ""
  resources:
  - events
  - configmaps
  - secrets
  - services
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-recorder-role
rules:
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-webhook-role
rules:
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - validatingwebhookconfigurations
  - mutatingwebhookconfigurations
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - core.cnrm.cloud.google.com
  resources:
  - servicemappings
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-deletiondefender-role-binding
  namespace: cnrm-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cnrm-deletiondefender-cnrm-system-role
subjects:
- kind: ServiceAccount
  name: cnrm-deletiondefender
  namespace: cnrm-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-webhook-role-binding
  namespace: cnrm-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cnrm-webhook-cnrm-system-role
subjects:
- kind: ServiceAccount
  name: cnrm-webhook-manager
  namespace: cnrm-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-admin-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cnrm-admin
subjects:
- kind: ServiceAccount
  name: cnrm-controller-manager
  namespace: cnrm-system
- kind: ServiceAccount
  name: cnrm-resource-stats-recorder
  namespace: cnrm-system
- kind: ServiceAccount
  name: cnrm-deletiondefender
  namespace: cnrm-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-deletiondefender-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cnrm-deletiondefender-role
subjects:
- kind: ServiceAccount
  name: cnrm-deletiondefender
  namespace: cnrm-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-manager-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cnrm-manager-cluster-role
subjects:
- kind: ServiceAccount
  name: cnrm-controller-manager
  namespace: cnrm-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-manager-watcher-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cnrm-manager-ns-role
subjects:
- kind: ServiceAccount
  name: cnrm-controller-manager
  namespace: cnrm-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-recorder-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cnrm-recorder-role
subjects:
- kind: ServiceAccount
  name: cnrm-resource-stats-recorder
  namespace: cnrm-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-webhook-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cnrm-webhook-role
subjects:
- kind: ServiceAccount
  name: cnrm-webhook-manager
  namespace: cnrm-system
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-deletiondefender
  namespace: cnrm-system
spec:
  ports:
  - name: deletiondefender
    port: 443
  selector:
    cnrm.cloud.google.com/component: cnrm-deletiondefender
    cnrm.cloud.google.com/system: "true"
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
    prometheus.io/port: "8888"
    prometheus.io/scrape: "true"
  labels:
    cnrm.cloud.google.com/monitored: "true"
    cnrm.cloud.google.com/system: "true"
  name: cnrm-manager
  namespace: cnrm-system
spec:
  ports:
  - name: controller-manager
    port: 443
  - name: metrics
    port: 8888
  selector:
    cnrm.cloud.google.com/component: cnrm-controller-manager
    cnrm.cloud.google.com/system: "true"
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
    prometheus.io/port: "8888"
    prometheus.io/scrape: "true"
  labels:
    cnrm.cloud.google.com/monitored: "true"
    cnrm.cloud.google.com/system: "true"
  name: cnrm-resource-stats-recorder-service
  namespace: cnrm-system
spec:
  ports:
  - name: metrics
    port: 8888
  selector:
    cnrm.cloud.google.com/component: cnrm-resource-stats-recorder
    cnrm.cloud.google.com/system: "true"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/component: cnrm-resource-stats-recorder
    cnrm.cloud.google.com/system: "true"
  name: cnrm-resource-stats-recorder
  namespace: cnrm-system
spec:
  replicas: 1
  revisionHistoryLimit: 1
  selector:
    matchLabels:
      cnrm.cloud.google.com/component: cnrm-resource-stats-recorder
      cnrm.cloud.google.com/system: "true"
  template:
    metadata:
      annotations:
        cnrm.cloud.google.com/version: 1.27.2
      labels:
        cnrm.cloud.google.com/component: cnrm-resource-stats-recorder
        cnrm.cloud.google.com/system: "true"
    spec:
      containers:
      - args:
        - --prometheus-scrape-endpoint=:8888
        - --metric-interval=60
        command:
        - /configconnector/recorder
        env:
        - name: CONFIG_CONNECTOR_VERSION
          value: 1.27.2
        image: gcr.io/cnrm-eap/recorder:1c8c589
        imagePullPolicy: Always
        name: recorder
        readinessProbe:
          exec:
            command:
            - cat
            - /tmp/ready
          initialDelaySeconds: 3
          periodSeconds: 3
        resources:
          limits:
            cpu: 40m
            memory: 64Mi
          requests:
            cpu: 20m
            memory: 32Mi
        securityContext:
          privileged: false
          runAsNonRoot: true
          runAsUser: 1000
      serviceAccountName: cnrm-resource-stats-recorder
      terminationGracePeriodSeconds: 10
---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/component: cnrm-webhook-manager
    cnrm.cloud.google.com/system: "true"
  name: cnrm-webhook-manager
  namespace: cnrm-system
spec:
  revisionHistoryLimit: 1
  selector:
    matchLabels:
      cnrm.cloud.google.com/component: cnrm-webhook-manager
      cnrm.cloud.google.com/system: "true"
  template:
    metadata:
      annotations:
        cnrm.cloud.google.com/version: 1.27.2
      labels:
        cnrm.cloud.google.com/component: cnrm-webhook-manager
        cnrm.cloud.google.com/system: "true"
    spec:
      containers:
      - args:
        - --stderrthreshold=INFO
        command:
        - /configconnector/webhook
        env:
        - name: NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: gcr.io/cnrm-eap/webhook:1c8c589
        imagePullPolicy: Always
        name: webhook
        readinessProbe:
          exec:
            command:
            - cat
            - /tmp/ready
          initialDelaySeconds: 3
          periodSeconds: 3
        resources:
          limits:
            cpu: 40m
            memory: 64Mi
        securityContext:
          privileged: false
          runAsNonRoot: true
          runAsUser: 1000
      serviceAccountName: cnrm-webhook-manager
      terminationGracePeriodSeconds: 10
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/component: cnrm-controller-manager
    cnrm.cloud.google.com/system: "true"
  name: cnrm-controller-manager
  namespace: cnrm-system
spec:
  selector:
    matchLabels:
      cnrm.cloud.google.com/component: cnrm-controller-manager
      cnrm.cloud.google.com/system: "true"
  serviceName: cnrm-manager
  template:
    metadata:
      annotations:
        cnrm.cloud.google.com/version: 1.27.2
      labels:
        cnrm.cloud.google.com/component: cnrm-controller-manager
        cnrm.cloud.google.com/system: "true"
    spec:
      containers:
      - args:
        - --stderrthreshold=INFO
        - --prometheus-scrape-endpoint=:8888
        command:
        - /configconnector/manager
        image: gcr.io/cnrm-eap/controller:1c8c589
        imagePullPolicy: Always
        name: manager
        readinessProbe:
          exec:
            command:
            - cat
            - /tmp/ready
          initialDelaySeconds: 3
          periodSeconds: 3
        resources:
          limits:
            cpu: 200m
            memory: 512Mi
          requests:
            cpu: 100m
            memory: 256Mi
        securityContext:
          privileged: false
          runAsNonRoot: true
          runAsUser: 1000
      serviceAccountName: cnrm-controller-manager
      terminationGracePeriodSeconds: 10
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/component: cnrm-deletiondefender
    cnrm.cloud.google.com/system: "true"
  name: cnrm-deletiondefender
  namespace: cnrm-system
spec:
  selector:
    matchLabels:
      cnrm.cloud.google.com/component: cnrm-deletiondefender
      cnrm.cloud.google.com/system: "true"
  serviceName: cnrm-deletiondefender
  template:
    metadata:
      annotations:
        cnrm.cloud.google.com/version: 1.27.2
      labels:
        cnrm.cloud.google.com/component: cnrm-deletiondefender
        cnrm.cloud.google.com/system: "true"
    spec:
      containers:
      - args:
        - --stderrthreshold=INFO
        command:
        - /configconnector/deletiondefender
        image: gcr.io/cnrm-eap/deletiondefender:1c8c589
        imagePullPolicy: Always
        name: deletiondefender
        readinessProbe:
          exec:
            command:
            - cat
            - /tmp/ready
          initialDelaySeconds: 3
          periodSeconds: 3
        resources:
          limits:
            cpu: 100m
            memory: 128Mi
          requests:
            memory: 64Mi
        securityContext:
          privileged: false
          runAsNonRoot: true
          runAsUser: 1000
      serviceAccountName: cnrm-deletiondefender
      terminationGracePeriodSeconds: 10
---
apiVersion: autoscaling/v2beta2
kind: HorizontalPodAutoscaler
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.27.2
  labels:
    cnrm.cloud.google.com/system: "true"
  name: cnrm-webhook
  namespace: cnrm-system
spec:
  maxReplicas: 10
  metrics:
  - resource:
      name: cpu
      target:
        averageUtilization: 60
        type: Utilization
    type: Resource
  minReplicas: 2
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: cnrm-webhook-manager
