### Namespace ###
kind: Namespace
apiVersion: v1
metadata:
  name: Namespace

### Service Account Controller ###
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: conduit-controller
  namespace: Namespace

### RBAC ###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: conduit-controller
rules:
- apiGroups: ["extensions"]
  resources: ["deployments", "replicasets"]
  verbs: ["list", "get", "watch"]
- apiGroups: [""]
  resources: ["pods", "endpoints", "services"]
  verbs: ["list", "get", "watch"]

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: conduit-controller
  namespace: Namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: conduit-controller
subjects:
- kind: ServiceAccount
  name: conduit-controller
  namespace: Namespace

### Service Account Prometheus ###
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: conduit-prometheus
  namespace: Namespace

### RBAC ###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: conduit-prometheus
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list", "watch"]

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: conduit-prometheus
  namespace: Namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: conduit-prometheus
subjects:
- kind: ServiceAccount
  name: conduit-prometheus
  namespace: Namespace

### Controller ###
---
kind: Service
apiVersion: v1
metadata:
  name: api
  namespace: Namespace
  labels:
    ControllerComponentLabel: controller
  annotations:
    CreatedByAnnotation: CliVersion
spec:
  type: ClusterIP
  selector:
    ControllerComponentLabel: controller
  ports:
  - name: http
    port: 8085
    targetPort: 8085

---
kind: Service
apiVersion: v1
metadata:
  name: proxy-api
  namespace: Namespace
  labels:
    ControllerComponentLabel: controller
  annotations:
    CreatedByAnnotation: CliVersion
spec:
  type: ClusterIP
  selector:
    ControllerComponentLabel: controller
  ports:
  - name: grpc
    port: 8086
    targetPort: 8086

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    CreatedByAnnotation: CliVersion
  creationTimestamp: null
  labels:
    ControllerComponentLabel: controller
  name: controller
  namespace: Namespace
spec:
  replicas: 1
  strategy: {}
  template:
    metadata:
      annotations:
        CreatedByAnnotation: CliVersion
        conduit.io/created-by: conduit/cli undefined
        conduit.io/proxy-version: undefined
      creationTimestamp: null
      labels:
        ControllerComponentLabel: controller
        conduit.io/control-plane-ns: Namespace
        conduit.io/proxy-deployment: controller
    spec:
      containers:
      - args:
        - public-api
        - -controller-namespace=Namespace
        - -log-level=ControllerLogLevel
        - -logtostderr=true
        image: ControllerImage
        imagePullPolicy: ImagePullPolicy
        name: public-api
        ports:
        - containerPort: 8085
          name: http
        - containerPort: 9995
          name: admin-http
        resources: {}
      - args:
        - destination
        - -log-level=ControllerLogLevel
        - -logtostderr=true
        image: ControllerImage
        imagePullPolicy: ImagePullPolicy
        name: destination
        ports:
        - containerPort: 8089
          name: grpc
        - containerPort: 9999
          name: admin-http
        resources: {}
      - args:
        - proxy-api
        - -log-level=ControllerLogLevel
        - -logtostderr=true
        image: ControllerImage
        imagePullPolicy: ImagePullPolicy
        name: proxy-api
        ports:
        - containerPort: 8086
          name: grpc
        - containerPort: 9996
          name: admin-http
        resources: {}
      - args:
        - tap
        - -log-level=ControllerLogLevel
        - -logtostderr=true
        image: ControllerImage
        imagePullPolicy: ImagePullPolicy
        name: tap
        ports:
        - containerPort: 8088
          name: grpc
        - containerPort: 9998
          name: admin-http
        resources: {}
      - args:
        - telemetry
        - -ignore-namespaces=kube-system
        - -prometheus-url=http://prometheus.Namespace.svc.cluster.local:9090
        - -log-level=ControllerLogLevel
        - -logtostderr=true
        image: ControllerImage
        imagePullPolicy: ImagePullPolicy
        name: telemetry
        ports:
        - containerPort: 8087
          name: grpc
        - containerPort: 9997
          name: admin-http
        resources: {}
      - env:
        - name: CONDUIT_PROXY_LOG
          value: warn,conduit_proxy=info
        - name: CONDUIT_PROXY_CONTROL_URL
          value: tcp://localhost:8086
        - name: CONDUIT_PROXY_CONTROL_LISTENER
          value: tcp://0.0.0.0:4190
        - name: CONDUIT_PROXY_METRICS_LISTENER
          value: tcp://0.0.0.0:4191
        - name: CONDUIT_PROXY_PRIVATE_LISTENER
          value: tcp://127.0.0.1:4140
        - name: CONDUIT_PROXY_PUBLIC_LISTENER
          value: tcp://0.0.0.0:4143
        - name: CONDUIT_PROXY_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: CONDUIT_PROXY_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: CONDUIT_PROXY_POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: gcr.io/runconduit/proxy:undefined
        imagePullPolicy: IfNotPresent
        name: conduit-proxy
        ports:
        - containerPort: 4143
          name: conduit-proxy
        - containerPort: 4191
          name: conduit-metrics
        resources: {}
        securityContext:
          runAsUser: 2102
      initContainers:
      - args:
        - --incoming-proxy-port
        - "4143"
        - --outgoing-proxy-port
        - "4140"
        - --proxy-uid
        - "2102"
        - --inbound-ports-to-ignore
        - "4190"
        image: gcr.io/runconduit/proxy-init:undefined
        imagePullPolicy: IfNotPresent
        name: conduit-init
        resources: {}
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
          privileged: false
      serviceAccount: conduit-controller
status: {}
---
kind: Service
apiVersion: v1
metadata:
  name: web
  namespace: Namespace
  labels:
    ControllerComponentLabel: web
  annotations:
    CreatedByAnnotation: CliVersion
spec:
  type: ClusterIP
  selector:
    ControllerComponentLabel: web
  ports:
  - name: http
    port: 8084
    targetPort: 8084
  - name: admin-http
    port: 9994
    targetPort: 9994

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    CreatedByAnnotation: CliVersion
  creationTimestamp: null
  labels:
    ControllerComponentLabel: web
  name: web
  namespace: Namespace
spec:
  replicas: 2
  strategy: {}
  template:
    metadata:
      annotations:
        CreatedByAnnotation: CliVersion
        conduit.io/created-by: conduit/cli undefined
        conduit.io/proxy-version: undefined
      creationTimestamp: null
      labels:
        ControllerComponentLabel: web
        conduit.io/control-plane-ns: Namespace
        conduit.io/proxy-deployment: web
    spec:
      containers:
      - args:
        - -api-addr=api.Namespace.svc.cluster.local:8085
        - -static-dir=/dist
        - -template-dir=/templates
        - -uuid=UUID
        - -controller-namespace=Namespace
        - -log-level=ControllerLogLevel
        image: WebImage
        imagePullPolicy: ImagePullPolicy
        name: web
        ports:
        - containerPort: 8084
          name: http
        - containerPort: 9994
          name: admin-http
        resources: {}
      - env:
        - name: CONDUIT_PROXY_LOG
          value: warn,conduit_proxy=info
        - name: CONDUIT_PROXY_CONTROL_URL
          value: tcp://proxy-api.Namespace.svc.cluster.local:8086
        - name: CONDUIT_PROXY_CONTROL_LISTENER
          value: tcp://0.0.0.0:4190
        - name: CONDUIT_PROXY_METRICS_LISTENER
          value: tcp://0.0.0.0:4191
        - name: CONDUIT_PROXY_PRIVATE_LISTENER
          value: tcp://127.0.0.1:4140
        - name: CONDUIT_PROXY_PUBLIC_LISTENER
          value: tcp://0.0.0.0:4143
        - name: CONDUIT_PROXY_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: CONDUIT_PROXY_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: CONDUIT_PROXY_POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: gcr.io/runconduit/proxy:undefined
        imagePullPolicy: IfNotPresent
        name: conduit-proxy
        ports:
        - containerPort: 4143
          name: conduit-proxy
        - containerPort: 4191
          name: conduit-metrics
        resources: {}
        securityContext:
          runAsUser: 2102
      initContainers:
      - args:
        - --incoming-proxy-port
        - "4143"
        - --outgoing-proxy-port
        - "4140"
        - --proxy-uid
        - "2102"
        - --inbound-ports-to-ignore
        - "4190"
        image: gcr.io/runconduit/proxy-init:undefined
        imagePullPolicy: IfNotPresent
        name: conduit-init
        resources: {}
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
          privileged: false
status: {}
---
kind: Service
apiVersion: v1
metadata:
  name: prometheus
  namespace: Namespace
  labels:
    ControllerComponentLabel: prometheus
  annotations:
    CreatedByAnnotation: CliVersion
spec:
  type: ClusterIP
  selector:
    ControllerComponentLabel: prometheus
  ports:
  - name: admin-http
    port: 9090
    targetPort: 9090

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    CreatedByAnnotation: CliVersion
  creationTimestamp: null
  labels:
    ControllerComponentLabel: prometheus
  name: prometheus
  namespace: Namespace
spec:
  replicas: 3
  strategy: {}
  template:
    metadata:
      annotations:
        CreatedByAnnotation: CliVersion
        conduit.io/created-by: conduit/cli undefined
        conduit.io/proxy-version: undefined
      creationTimestamp: null
      labels:
        ControllerComponentLabel: prometheus
        conduit.io/control-plane-ns: Namespace
        conduit.io/proxy-deployment: prometheus
    spec:
      containers:
      - args:
        - --storage.tsdb.retention=6h
        - --config.file=/etc/prometheus/prometheus.yml
        image: PrometheusImage
        imagePullPolicy: ImagePullPolicy
        name: prometheus
        ports:
        - containerPort: 9090
          name: admin-http
        resources: {}
        volumeMounts:
        - mountPath: /etc/prometheus
          name: prometheus-config
          readOnly: true
      - env:
        - name: CONDUIT_PROXY_LOG
          value: warn,conduit_proxy=info
        - name: CONDUIT_PROXY_CONTROL_URL
          value: tcp://proxy-api.Namespace.svc.cluster.local:8086
        - name: CONDUIT_PROXY_CONTROL_LISTENER
          value: tcp://0.0.0.0:4190
        - name: CONDUIT_PROXY_METRICS_LISTENER
          value: tcp://0.0.0.0:4191
        - name: CONDUIT_PROXY_PRIVATE_LISTENER
          value: tcp://127.0.0.1:4140
        - name: CONDUIT_PROXY_PUBLIC_LISTENER
          value: tcp://0.0.0.0:4143
        - name: CONDUIT_PROXY_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: CONDUIT_PROXY_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: CONDUIT_PROXY_POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: gcr.io/runconduit/proxy:undefined
        imagePullPolicy: IfNotPresent
        name: conduit-proxy
        ports:
        - containerPort: 4143
          name: conduit-proxy
        - containerPort: 4191
          name: conduit-metrics
        resources: {}
        securityContext:
          runAsUser: 2102
      initContainers:
      - args:
        - --incoming-proxy-port
        - "4143"
        - --outgoing-proxy-port
        - "4140"
        - --proxy-uid
        - "2102"
        - --inbound-ports-to-ignore
        - "4190"
        image: gcr.io/runconduit/proxy-init:undefined
        imagePullPolicy: IfNotPresent
        name: conduit-init
        resources: {}
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
          privileged: false
      serviceAccount: conduit-prometheus
      volumes:
      - configMap:
          name: prometheus-config
        name: prometheus-config
status: {}
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: prometheus-config
  namespace: Namespace
  labels:
    ControllerComponentLabel: prometheus
  annotations:
    CreatedByAnnotation: CliVersion
data:
  prometheus.yml: |-
    global:
      scrape_interval: 10s
      evaluation_interval: 10s

    scrape_configs:
    - job_name: 'prometheus'
      static_configs:
      - targets: ['localhost:9090']

    - job_name: 'controller'
      kubernetes_sd_configs:
      - role: pod
        namespaces:
          names: ['Namespace']
      relabel_configs:
      - source_labels: [__meta_kubernetes_pod_container_port_name]
        action: keep
        regex: ^admin-http$
      - source_labels: [__meta_kubernetes_pod_container_name]
        action: replace
        target_label: job

    # Double collect control-plane pods, In #499 we will remove the
    # "controller" job above in favor of these two below.
    - job_name: 'conduit-controller'
      kubernetes_sd_configs:
      - role: pod
        namespaces:
          names: ['Namespace']
      # TODO: do something with "conduit.io/control-plane-component"
      relabel_configs:
      - source_labels:
        - __meta_kubernetes_pod_label_conduit_io_control_plane_component
        - __meta_kubernetes_pod_container_port_name
        action: keep
        regex: (.*);admin-http$
      - source_labels: [__meta_kubernetes_pod_container_name]
        action: replace
        target_label: component

    - job_name: 'conduit-proxy'
      kubernetes_sd_configs:
      - role: pod
      relabel_configs:
      - source_labels:
        - __meta_kubernetes_pod_container_name
        - __meta_kubernetes_pod_container_port_name
        action: keep
        regex: ^conduit-proxy;conduit-metrics$
      - source_labels: [__meta_kubernetes_namespace]
        action: replace
        target_label: namespace
      - source_labels: [__meta_kubernetes_pod_name]
        action: replace
        target_label: pod_name
      # special case k8s' "job" label, to not interfere with prometheus' "job"
      # label
      # __meta_kubernetes_pod_label_conduit_io_proxy_job=foo =>
      # k8s_job=foo
      - source_labels: [__meta_kubernetes_pod_label_conduit_io_proxy_job]
        action: replace
        target_label: k8s_job
      # __meta_kubernetes_pod_label_conduit_io_proxy_deployment=foo =>
      # deployment=foo
      - action: labelmap
        regex: __meta_kubernetes_pod_label_conduit_io_proxy_(.+)
      # drop all labels that we just made copies of in the previous labelmap
      - action: labeldrop
        regex: __meta_kubernetes_pod_label_conduit_io_proxy_(.+)
      # __meta_kubernetes_pod_label_foo=bar => foo=bar
      - action: labelmap
        regex: __meta_kubernetes_pod_label_(.+)

### Grafana ###
---
kind: Service
apiVersion: v1
metadata:
  name: grafana
  namespace: Namespace
  labels:
    ControllerComponentLabel: grafana
  annotations:
    CreatedByAnnotation: CliVersion
spec:
  type: ClusterIP
  selector:
    ControllerComponentLabel: grafana
  ports:
  - name: http
    port: 3000
    targetPort: 3000

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    CreatedByAnnotation: CliVersion
  creationTimestamp: null
  labels:
    ControllerComponentLabel: grafana
  name: grafana
  namespace: Namespace
spec:
  replicas: 1
  strategy: {}
  template:
    metadata:
      annotations:
        CreatedByAnnotation: CliVersion
        conduit.io/created-by: conduit/cli undefined
        conduit.io/proxy-version: undefined
      creationTimestamp: null
      labels:
        ControllerComponentLabel: grafana
        conduit.io/control-plane-ns: Namespace
        conduit.io/proxy-deployment: grafana
    spec:
      containers:
      - image: GrafanaImage
        imagePullPolicy: ImagePullPolicy
        name: grafana
        ports:
        - containerPort: 3000
          name: http
        resources: {}
        volumeMounts:
        - mountPath: /etc/grafana
          name: grafana-config
          readOnly: true
        - mountPath: /var/lib/grafana/dashboards
          name: grafana-dashboards
        - mountPath: /usr/share/grafana/public/dashboards
          name: grafana-dashboard-home
          readOnly: true
      - env:
        - name: CONDUIT_PROXY_LOG
          value: warn,conduit_proxy=info
        - name: CONDUIT_PROXY_CONTROL_URL
          value: tcp://proxy-api.Namespace.svc.cluster.local:8086
        - name: CONDUIT_PROXY_CONTROL_LISTENER
          value: tcp://0.0.0.0:4190
        - name: CONDUIT_PROXY_METRICS_LISTENER
          value: tcp://0.0.0.0:4191
        - name: CONDUIT_PROXY_PRIVATE_LISTENER
          value: tcp://127.0.0.1:4140
        - name: CONDUIT_PROXY_PUBLIC_LISTENER
          value: tcp://0.0.0.0:4143
        - name: CONDUIT_PROXY_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: CONDUIT_PROXY_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: CONDUIT_PROXY_POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: gcr.io/runconduit/proxy:undefined
        imagePullPolicy: IfNotPresent
        name: conduit-proxy
        ports:
        - containerPort: 4143
          name: conduit-proxy
        - containerPort: 4191
          name: conduit-metrics
        resources: {}
        securityContext:
          runAsUser: 2102
      initContainers:
      - args:
        - --incoming-proxy-port
        - "4143"
        - --outgoing-proxy-port
        - "4140"
        - --proxy-uid
        - "2102"
        - --inbound-ports-to-ignore
        - "4190"
        image: gcr.io/runconduit/proxy-init:undefined
        imagePullPolicy: IfNotPresent
        name: conduit-init
        resources: {}
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
          privileged: false
      volumes:
      - configMap:
          items:
          - key: grafana.ini
            path: grafana.ini
          - key: datasources.yaml
            path: provisioning/datasources/datasources.yaml
          - key: dashboards.yaml
            path: provisioning/dashboards/dashboards.yaml
          name: grafana-config
        name: grafana-config
      - configMap:
          name: grafana-dashboards
        name: grafana-dashboards
      - configMap:
          items:
          - key: conduit-top-line.json
            path: home.json
          name: grafana-dashboards
        name: grafana-dashboard-home
status: {}
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: grafana-config
  namespace: Namespace
  labels:
    ControllerComponentLabel: grafana
  annotations:
    CreatedByAnnotation: CliVersion
data:
  grafana.ini: |-
    instance_name = conduit-grafana

    [server]
    root_url = %(protocol)s://%(domain)s:/api/v1/namespaces/Namespace/services/grafana:http/proxy/

    [auth]
    disable_login_form = true

    [auth.anonymous]
    enabled = true
    org_role = Editor

    [auth.basic]
    enabled = false

    [analytics]
    check_for_updates = false

  datasources.yaml: |-
    apiVersion: 1
    datasources:
    - name: prometheus
      type: prometheus
      access: proxy
      orgId: 1
      url: http://prometheus.Namespace.svc.cluster.local:9090
      isDefault: true
      jsonData:
        timeInterval: "5s"
      version: 1
      editable: true

  dashboards.yaml: |-
    apiVersion: 1
    providers:
    - name: 'default'
      orgId: 1
      folder: ''
      type: file
      disableDeletion: true
      editable: true
      options:
        path: /var/lib/grafana/dashboards
        homeDashboardId: conduit-top-line

### Grafana ConfigMap ###
# The ConfigMap below contains Grafana dashboards in the form of JSON files.
# These JSON dashboard files constitute the majority of the "conduit install"
# output, pushing this entire config to nearly 100kb. Open issue to explore
# alternatives: https://github.com/runconduit/conduit/issues/567
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: grafana-dashboards
  namespace: Namespace
  labels:
    ControllerComponentLabel: grafana
  annotations:
    CreatedByAnnotation: CliVersion
data:
  conduit-top-line.json: |-
    TopLineDashboard

  conduit-deployment.json: |-
    DeploymentDashboard

  conduit-health.json: |-
    HealthDashboard
---
