---
###
### Linkerd Viz Extension Namespace
###
kind: Namespace
apiVersion: v1
metadata:
  name: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
  annotations:
    linkerd.io/inject: enabled
---
###
### Metrics API RBAC
###
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-metrics-api
  labels:
    linkerd.io/extension: linkerd-viz
    component: metrics-api
rules:
- apiGroups: ["extensions", "apps"]
  resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "batch"]
  resources: ["cronjobs", "jobs"]
  verbs: ["list" , "get", "watch"]
- apiGroups: [""]
  resources: ["pods", "endpoints", "services", "replicationcontrollers", "namespaces"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["linkerd.io"]
  resources: ["serviceprofiles"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["split.smi-spec.io"]
  resources: ["trafficsplits"]
  verbs: ["list", "get", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-metrics-api
  labels:
    linkerd.io/extension: linkerd-viz
    component: metrics-api
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-viz-metrics-api
subjects:
- kind: ServiceAccount
  name: linkerd-metrics-api
  namespace: linkerd-viz
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-metrics-api
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: metrics-api
---
###
### Grafana RBAC
###
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-grafana
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: grafana
    namespace: linkerd-viz
---
###
### Prometheus RBAC
###
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-prometheus
  labels:
    linkerd.io/extension: linkerd-viz
    component: prometheus
rules:
- apiGroups: [""]
  resources: ["nodes", "nodes/proxy", "pods"]
  verbs: ["get", "list", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-prometheus
  labels:
    linkerd.io/extension: linkerd-viz
    component: prometheus
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-viz-prometheus
subjects:
- kind: ServiceAccount
  name: linkerd-prometheus
  namespace: linkerd-viz
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-prometheus
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: prometheus
    namespace: linkerd-viz
---
###
### Tap RBAC
###
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-tap
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
rules:
- apiGroups: [""]
  resources: ["pods", "services", "replicationcontrollers", "namespaces", "nodes"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "apps"]
  resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "batch"]
  resources: ["cronjobs", "jobs"]
  verbs: ["list" , "get", "watch"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-tap-admin
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
rules:
- apiGroups: ["tap.linkerd.io"]
  resources: ["*"]
  verbs: ["watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-tap
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-viz-tap
subjects:
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd-viz
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: linkerd-linkerd-viz-tap-auth-delegator
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd-viz
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-tap
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
    namespace: linkerd-viz
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: linkerd-linkerd-viz-tap-auth-reader
  namespace: kube-system
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
    namespace: linkerd-viz
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd-viz
---
kind: Secret
apiVersion: v1
metadata:
  name: linkerd-tap-k8s-tls
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
    namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
type: kubernetes.io/tls
data:
  tls.crt: dGVzdC10YXAtY3J0LXBlbQ==
  tls.key: dGVzdC10YXAta2V5LXBlbQ==
---
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1alpha1.tap.linkerd.io
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
spec:
  group: tap.linkerd.io
  version: v1alpha1
  groupPriorityMinimum: 1000
  versionPriority: 100
  service:
    name: linkerd-tap
    namespace: linkerd-viz
  caBundle: dGVzdC10YXAtY2EtYnVuZGxl
---
###
### Web RBAC
###
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: linkerd-web
  namespace: linkerd
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
    namespace: linkerd
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get"]
  resourceNames: ["linkerd-config"]
- apiGroups: [""]
  resources: ["namespaces", "configmaps"]
  verbs: ["get"]
- apiGroups: [""]
  resources: ["serviceaccounts", "pods"]
  verbs: ["list"]
- apiGroups: ["apps"]
  resources: ["replicasets"]
  verbs: ["list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: linkerd-web
  namespace: linkerd
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
    namespace: linkerd
roleRef:
  kind: Role
  name: linkerd-web
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd-viz
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: linkerd-linkerd-viz-web-check
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
rules:
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles", "clusterrolebindings"]
  verbs: ["list"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["list"]
- apiGroups: ["admissionregistration.k8s.io"]
  resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
  verbs: ["list"]
- apiGroups: ["policy"]
  resources: ["podsecuritypolicies"]
  verbs: ["list"]
- apiGroups: ["linkerd.io"]
  resources: ["serviceprofiles"]
  verbs: ["list"]
- apiGroups: ["apiregistration.k8s.io"]
  resources: ["apiservices"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: linkerd-linkerd-viz-web-check
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
roleRef:
  kind: ClusterRole
  name: linkerd-linkerd-viz-web-check
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd-viz
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-viz-web-admin
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-viz-tap-admin
subjects:
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd-viz
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-web
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
    namespace: linkerd-viz
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: linkerd-viz-psp
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    namespace: linkerd-viz
roleRef:
  kind: Role
  name: linkerd-psp
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd-viz
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd-viz
- kind: ServiceAccount
  name: linkerd-grafana
  namespace: linkerd-viz
- kind: ServiceAccount
  name: linkerd-prometheus
  namespace: linkerd-viz
---
###
### Metrics API
###
kind: Service
apiVersion: v1
metadata:
  name: linkerd-metrics-api
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: metrics-api
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
spec:
  type: ClusterIP
  selector:
    linkerd.io/extension: linkerd-viz
    component: metrics-api
  ports:
  - name: http
    port: 8085
    targetPort: 8085
---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
  labels:
    linkerd.io/extension: linkerd-viz
    app.kubernetes.io/name: metrics-api
    app.kubernetes.io/part-of: Linkerd
    app.kubernetes.io/version: dev-undefined
    component: metrics-api
  name: linkerd-metrics-api
  namespace: linkerd-viz
spec:
  replicas: 1
  selector:
    matchLabels:
      linkerd.io/extension: linkerd-viz
      component: metrics-api
  template:
    metadata:
      annotations:
        checksum/config: 6827b2203b1cd90692d9dd6a973a2162e574dc9fd7b5b9e346ceac7e287204a6
        linkerd.io/created-by: linkerd/helm dev-undefined
      labels:
        linkerd.io/extension: linkerd-viz
        component: metrics-api
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      containers:
      - args:
        - -controller-namespace=linkerd
        - -log-level=info
        - -cluster-domain=cluster.local
        - -prometheus-url=http://linkerd-prometheus.linkerd-viz.svc.cluster.local:9090
        image: ghcr.io/linkerd/metrics-api:dev-undefined
        imagePullPolicy: 
        livenessProbe:
          httpGet:
            path: /ping
            port: 9995
          initialDelaySeconds: 10
        name: metrics-api
        ports:
        - containerPort: 8085
          name: http
        - containerPort: 9995
          name: admin-http
        readinessProbe:
          failureThreshold: 7
          httpGet:
            path: /ready
            port: 9995
        resources:
        securityContext:
          runAsUser: 2103
      serviceAccountName: linkerd-metrics-api
---
###
### Grafana
###
kind: ConfigMap
apiVersion: v1
metadata:
  name: linkerd-grafana-config
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: grafana
    namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
data:
  grafana.ini: |-
    instance_name = linkerd-grafana
    [server]
    root_url = %(protocol)s://%(domain)s:/grafana/
    [auth]
    disable_login_form = true
    [auth.anonymous]
    enabled = true
    org_role = Editor
    [auth.basic]
    enabled = false
    [analytics]
    check_for_updates = false
    [panels]
    disable_sanitize_html = true
  datasources.yaml: |-
    apiVersion: 1
    datasources:
    - name: prometheus
      type: prometheus
      access: proxy
      orgId: 1
      url: http://linkerd-prometheus.linkerd-viz.svc.cluster.local:9090
      isDefault: true
      jsonData:
        timeInterval: "5s"
      version: 1
      editable: true

  dashboards.yaml: |-
    apiVersion: 1
    providers:
    - name: 'default'
      orgId: 1
      folder: ''
      type: file
      disableDeletion: true
      editable: true
      options:
        path: /var/lib/grafana/dashboards
        homeDashboardId: linkerd-top-line
---
kind: Service
apiVersion: v1
metadata:
  name: linkerd-grafana
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: grafana
    namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
spec:
  type: ClusterIP
  selector:
    linkerd.io/extension: linkerd-viz
    component: grafana
  ports:
  - name: http
    port: 3000
    targetPort: 3000
---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
  labels:
    linkerd.io/extension: linkerd-viz
    app.kubernetes.io/name: grafana
    app.kubernetes.io/part-of: Linkerd
    app.kubernetes.io/version: dev-undefined
    component: grafana
    namespace: linkerd-viz
  name: linkerd-grafana
  namespace: linkerd-viz
spec:
  replicas: 1
  selector:
    matchLabels:
      linkerd.io/extension: linkerd-viz
      component: grafana
      namespace: linkerd-viz
  template:
    metadata:
      annotations:
        linkerd.io/created-by: linkerd/helm dev-undefined
      labels:
        linkerd.io/extension: linkerd-viz
        component: grafana
        namespace: linkerd-viz
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      containers:
      - env:
        - name: GF_PATHS_DATA
          value: /data
        # Force using the go-based DNS resolver instead of the OS' to avoid failures in some environments
        # see https://github.com/grafana/grafana/issues/20096
        - name: GODEBUG
          value: netdns=go
        image: ghcr.io/linkerd/grafana:dev-undefined
        imagePullPolicy: 
        livenessProbe:
          httpGet:
            path: /api/health
            port: 3000
          initialDelaySeconds: 30
        name: grafana
        ports:
        - containerPort: 3000
          name: http
        readinessProbe:
          httpGet:
            path: /api/health
            port: 3000
        resources:
        securityContext:
          runAsUser: 472
        volumeMounts:
        - mountPath: /data
          name: data
        - mountPath: /etc/grafana
          name: grafana-config
          readOnly: true
      serviceAccountName: linkerd-grafana
      volumes:
      - emptyDir: {}
        name: data
      - configMap:
          items:
          - key: grafana.ini
            path: grafana.ini
          - key: datasources.yaml
            path: provisioning/datasources/datasources.yaml
          - key: dashboards.yaml
            path: provisioning/dashboards/dashboards.yaml
          name: linkerd-grafana-config
        name: grafana-config
---
###
### Prometheus
###
kind: ConfigMap
apiVersion: v1
metadata:
  name: linkerd-prometheus-config
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: prometheus
    namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
data:
  prometheus.yml: |-
    global:
      evaluation_interval: 10s
      scrape_interval: 10s
      scrape_timeout: 10s

    rule_files:
    - /etc/prometheus/*_rules.yml
    - /etc/prometheus/*_rules.yaml

    scrape_configs:
    - job_name: 'prometheus'
      static_configs:
      - targets: ['localhost:9090']

    - job_name: 'grafana'
      kubernetes_sd_configs:
      - role: pod
        namespaces:
          names: ['linkerd-viz']
      relabel_configs:
      - source_labels:
        - __meta_kubernetes_pod_container_name
        action: keep
        regex: ^grafana$

    #  Required for: https://grafana.com/grafana/dashboards/315
    - job_name: 'kubernetes-nodes-cadvisor'
      scheme: https
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecure_skip_verify: true
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
      - role: node
      relabel_configs:
      - action: labelmap
        regex: __meta_kubernetes_node_label_(.+)
      - target_label: __address__
        replacement: kubernetes.default.svc:443
      - source_labels: [__meta_kubernetes_node_name]
        regex: (.+)
        target_label: __metrics_path__
        replacement: /api/v1/nodes/$1/proxy/metrics/cadvisor
      metric_relabel_configs:
      - source_labels: [__name__]
        regex: '(container|machine)_(cpu|memory|network|fs)_(.+)'
        action: keep
      - source_labels: [__name__]
        regex: 'container_memory_failures_total' # unneeded large metric
        action: drop

    - job_name: 'linkerd-controller'
      kubernetes_sd_configs:
      - role: pod
        namespaces:
          names:
          - 'linkerd'
          - 'linkerd-viz'
      relabel_configs:
      - source_labels:
        - __meta_kubernetes_pod_container_port_name
        action: keep
        regex: admin-http
      - source_labels: [__meta_kubernetes_pod_container_name]
        action: replace
        target_label: component

    - job_name: 'linkerd-service-mirror'
      kubernetes_sd_configs:
      - role: pod
      relabel_configs:
      - source_labels:
        - __meta_kubernetes_pod_label_linkerd_io_control_plane_component
        - __meta_kubernetes_pod_container_port_name
        action: keep
        regex: linkerd-service-mirror;admin-http$
      - source_labels: [__meta_kubernetes_pod_container_name]
        action: replace
        target_label: component

    - job_name: 'linkerd-proxy'
      kubernetes_sd_configs:
      - role: pod
      relabel_configs:
      - source_labels:
        - __meta_kubernetes_pod_container_name
        - __meta_kubernetes_pod_container_port_name
        - __meta_kubernetes_pod_label_linkerd_io_control_plane_ns
        action: keep
        regex: ^linkerd-proxy;linkerd-admin;linkerd$
      - source_labels: [__meta_kubernetes_namespace]
        action: replace
        target_label: namespace
      - source_labels: [__meta_kubernetes_pod_name]
        action: replace
        target_label: pod
      # special case k8s' "job" label, to not interfere with prometheus' "job"
      # label
      # __meta_kubernetes_pod_label_linkerd_io_proxy_job=foo =>
      # k8s_job=foo
      - source_labels: [__meta_kubernetes_pod_label_linkerd_io_proxy_job]
        action: replace
        target_label: k8s_job
      # drop __meta_kubernetes_pod_label_linkerd_io_proxy_job
      - action: labeldrop
        regex: __meta_kubernetes_pod_label_linkerd_io_proxy_job
      # __meta_kubernetes_pod_label_linkerd_io_proxy_deployment=foo =>
      # deployment=foo
      - action: labelmap
        regex: __meta_kubernetes_pod_label_linkerd_io_proxy_(.+)
      # drop all labels that we just made copies of in the previous labelmap
      - action: labeldrop
        regex: __meta_kubernetes_pod_label_linkerd_io_proxy_(.+)
      # __meta_kubernetes_pod_label_linkerd_io_foo=bar =>
      # foo=bar
      - action: labelmap
        regex: __meta_kubernetes_pod_label_linkerd_io_(.+)
      # Copy all pod labels to tmp labels
      - action: labelmap
        regex: __meta_kubernetes_pod_label_(.+)
        replacement: __tmp_pod_label_$1
      # Take `linkerd_io_` prefixed labels and copy them without the prefix
      - action: labelmap
        regex: __tmp_pod_label_linkerd_io_(.+)
        replacement:  __tmp_pod_label_$1
      # Drop the `linkerd_io_` originals
      - action: labeldrop
        regex: __tmp_pod_label_linkerd_io_(.+)
      # Copy tmp labels into real labels
      - action: labelmap
        regex: __tmp_pod_label_(.+)
---
kind: Service
apiVersion: v1
metadata:
  name: linkerd-prometheus
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: prometheus
    namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
spec:
  type: ClusterIP
  selector:
    linkerd.io/extension: linkerd-viz
    component: prometheus
  ports:
  - name: admin-http
    port: 9090
    targetPort: 9090
---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
  labels:
    linkerd.io/extension: linkerd-viz
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: Linkerd
    app.kubernetes.io/version: dev-undefined
    component: prometheus
    namespace: linkerd-viz
  name: linkerd-prometheus
  namespace: linkerd-viz
spec:
  replicas: 1
  selector:
    matchLabels:
      linkerd.io/extension: linkerd-viz
      component: prometheus
      namespace: linkerd-viz
  template:
    metadata:
      annotations:
        linkerd.io/created-by: linkerd/helm dev-undefined
      labels:
        linkerd.io/extension: linkerd-viz
        component: prometheus
        namespace: linkerd-viz
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      securityContext:
        fsGroup: 65534
      containers:
      - args:
        - --config.file=/etc/prometheus/prometheus.yml
        - --log.level=info
        - --storage.tsdb.path=/data
        - --storage.tsdb.retention.time=6h
        image: prom/prometheus:v2.19.3
        imagePullPolicy: 
        livenessProbe:
          httpGet:
            path: /-/healthy
            port: 9090
          initialDelaySeconds: 30
          timeoutSeconds: 30
        name: prometheus
        ports:
        - containerPort: 9090
          name: admin-http
        readinessProbe:
          httpGet:
            path: /-/ready
            port: 9090
          initialDelaySeconds: 30
          timeoutSeconds: 30
        resources:
        securityContext:
          runAsNonRoot: true
          runAsUser: 65534
          runAsGroup: 65534
        volumeMounts:
        - mountPath: /data
          name: data
        - mountPath: /etc/prometheus/prometheus.yml
          name: prometheus-config
          subPath: prometheus.yml
          readOnly: true
      serviceAccountName: linkerd-prometheus
      volumes:
      - name: data
        emptyDir: {}
      - configMap:
          name: linkerd-prometheus-config
        name: prometheus-config
---
###
### Tap
###
kind: Service
apiVersion: v1
metadata:
  name: linkerd-tap
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap
    namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
spec:
  type: ClusterIP
  selector:
    linkerd.io/extension: linkerd-viz
    component: tap
  ports:
  - name: grpc
    port: 8088
    targetPort: 8088
  - name: apiserver
    port: 443
    targetPort: apiserver
---
kind: Deployment
apiVersion: apps/v1
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
  labels:
    linkerd.io/extension: linkerd-viz
    app.kubernetes.io/name: tap
    app.kubernetes.io/part-of: Linkerd
    app.kubernetes.io/version: dev-undefined
    component: tap
    namespace: linkerd-viz
  name: linkerd-tap
  namespace: linkerd-viz
spec:
  replicas: 1
  selector:
    matchLabels:
      linkerd.io/extension: linkerd-viz
      component: tap
      namespace: linkerd-viz
  template:
    metadata:
      annotations:
        checksum/config: bbc82b03e8c9fdc549e1ef5d3f795c07c21fb3b4c089351186f170b722689d86
        linkerd.io/created-by: linkerd/helm dev-undefined
      labels:
        linkerd.io/extension: linkerd-viz
        component: tap
        namespace: linkerd-viz
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      containers:
      - args:
        - api
        - -api-namespace=linkerd
        - -log-level=info
        - -identity-trust-domain=cluster.local
        image: ghcr.io/linkerd/tap:dev-undefined
        imagePullPolicy: 
        livenessProbe:
          httpGet:
            path: /ping
            port: 9998
          initialDelaySeconds: 10
        name: tap
        ports:
        - containerPort: 8088
          name: grpc
        - containerPort: 8089
          name: apiserver
        - containerPort: 9998
          name: admin-http
        readinessProbe:
          failureThreshold: 7
          httpGet:
            path: /ready
            port: 9998
        resources:
        securityContext:
          runAsUser: 2103
        volumeMounts:
        - mountPath: /var/run/linkerd/tls
          name: tls
          readOnly: true
      serviceAccountName: linkerd-tap
      volumes:
      - name: tls
        secret:
          secretName: linkerd-tap-k8s-tls

---
###
### Tap Injector RBAC
###
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-tap-injector
  labels:
    linkerd.io/extension: linkerd-viz
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-tap-injector
  labels:
    linkerd.io/extension: linkerd-viz
subjects:
- kind: ServiceAccount
  name: tap-injector
  namespace: linkerd-viz
roleRef:
  kind: ClusterRole
  name: linkerd-tap-injector
  apiGroup: rbac.authorization.k8s.io
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: tap-injector
  namespace: linkerd-viz
---
kind: Secret
apiVersion: v1
metadata:
  name: tap-injector-k8s-tls
  namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
type: kubernetes.io/tls
data:
  tls.crt: dGVzdC10YXAtY3J0LXBlbQ==
  tls.key: dGVzdC10YXAta2V5LXBlbQ==
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: linkerd-tap-injector-webhook-config
  labels:
    linkerd.io/extension: linkerd-viz
webhooks:
- name: tap-injector.linkerd.io
  clientConfig:
    service:
      name: tap-injector
      namespace: linkerd-viz
      path: "/"
    caBundle: dGVzdC10YXAtY2EtYnVuZGxl
  failurePolicy: Ignore
  admissionReviewVersions: ["v1", "v1beta1"]
  reinvocationPolicy: IfNeeded
  rules:
  - operations: [ "CREATE" ]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  sideEffects: None
---
###
### Tap Injector
###
kind: Service
apiVersion: v1
metadata:
  name: tap-injector
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: tap-injector
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
spec:
  type: ClusterIP
  selector:
    component: tap-injector
  ports:
  - name: tap-injector
    port: 443
    targetPort: tap-injector
---
kind: Deployment
apiVersion: apps/v1
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
  labels:
    linkerd.io/extension: linkerd-viz
    app.kubernetes.io/name: tap-injector
    app.kubernetes.io/part-of: Linkerd
    component: tap-injector
  name: tap-injector
  namespace: linkerd-viz
spec:
  replicas: 1
  selector:
    matchLabels:
      component: tap-injector
  template:
    metadata:
      annotations:
        checksum/config: 0120b5feafdef04a057ab39fd63ed315ebbcc2bfc0b0657e3007fa34ffb8b7e2
        linkerd.io/created-by: linkerd/helm dev-undefined
      labels:
        linkerd.io/extension: linkerd-viz
        component: tap-injector
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      containers:
      - args:
        - injector
        - -tap-service-name=linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
        - -log-level=info
        image: ghcr.io/linkerd/tap:dev-undefined
        imagePullPolicy: 
        livenessProbe:
          httpGet:
            path: /ping
            port: 9995
          initialDelaySeconds: 10
        name: tap-injector
        ports:
        - containerPort: 8443
          name: tap-injector
        - containerPort: 9995
          name: admin-http
        readinessProbe:
          failureThreshold: 7
          httpGet:
            path: /ready
            port: 9995
        resources:
        securityContext:
          runAsUser: 2103
        volumeMounts:
        - mountPath: /var/run/linkerd/tls
          name: tls
          readOnly: true
      serviceAccountName: tap-injector
      volumes:
      - name: tls
        secret:
          secretName: tap-injector-k8s-tls
---
###
### Web
###
kind: Service
apiVersion: v1
metadata:
  name: linkerd-web
  namespace: linkerd-viz
  labels:
    linkerd.io/extension: linkerd-viz
    component: web
    namespace: linkerd-viz
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
spec:
  type: ClusterIP
  selector:
    linkerd.io/extension: linkerd-viz
    component: web
  ports:
  - name: http
    port: 8084
    targetPort: 8084
  - name: admin-http
    port: 9994
    targetPort: 9994
---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    linkerd.io/created-by: linkerd/helm dev-undefined
  labels:
    linkerd.io/extension: linkerd-viz
    app.kubernetes.io/name: web
    app.kubernetes.io/part-of: Linkerd
    app.kubernetes.io/version: dev-undefined
    component: web
    namespace: linkerd-viz
  name: linkerd-web
  namespace: linkerd-viz
spec:
  replicas: 1
  selector:
    matchLabels:
      linkerd.io/extension: linkerd-viz
      component: web
      namespace: linkerd-viz
  template:
    metadata:
      annotations:
        linkerd.io/created-by: linkerd/helm dev-undefined
      labels:
        linkerd.io/extension: linkerd-viz
        component: web
        namespace: linkerd-viz
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      containers:
      - args:
        - -linkerd-controller-api-addr=linkerd-controller-api.linkerd.svc.cluster.local:8085
        - -linkerd-metrics-api-addr=linkerd-metrics-api.linkerd-viz.svc.cluster.local:8085
        - -cluster-domain=cluster.local
        - -grafana-addr=linkerd-grafana.linkerd-viz.svc.cluster.local:3000
        - -controller-namespace=linkerd
        - -viz-namespace=linkerd-viz
        - -log-level=info
        - -enforced-host=^(localhost|127\.0\.0\.1|linkerd-web\.linkerd-viz\.svc\.cluster\.local|linkerd-web\.linkerd-viz\.svc|\[::1\])(:\d+)?$
        image: ghcr.io/linkerd/web:dev-undefined
        imagePullPolicy: 
        livenessProbe:
          httpGet:
            path: /ping
            port: 9994
          initialDelaySeconds: 10
        name: web
        ports:
        - containerPort: 8084
          name: http
        - containerPort: 9994
          name: admin-http
        readinessProbe:
          failureThreshold: 7
          httpGet:
            path: /ready
            port: 9994
        resources:
        securityContext:
          runAsUser: 2103
      serviceAccountName: linkerd-web