# GENERATED FILE: edits made by hand will not be preserved.

######################################################################
# 'ambassador' namespace.
---
apiVersion: v1
kind: Namespace
metadata:
  name: ambassador
  labels:
    product: aes

######################################################################
# RBAC
# NB: ClusterRoles and ClusterRoleBindings are not namespaced
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ambassador
  namespace: ambassador
  labels:
    product: aes

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: ambassador
  labels:
    product: aes
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ambassador
subjects:
- kind: ServiceAccount
  name: ambassador
  namespace: ambassador

######################################################################
# Project RBAC
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador-projects
  labels:
    product: aes
rules:
- apiGroups: [""]
  resources: [ "secrets", "services" ]
  verbs: [ "get", "list", "create", "patch", "delete", "watch" ]
- apiGroups: ["apps"]
  resources: [ "deployments" ]
  verbs: [ "get", "list", "create", "patch", "delete", "watch" ]
- apiGroups: ["batch"]
  resources: [ "jobs" ]
  verbs: [ "get", "list", "create", "patch", "delete", "watch" ]
- apiGroups: [""]
  resources: [ "pods" ]
  verbs: [ "get", "list", "watch" ]
- apiGroups: [""]
  resources: [ "pods/log" ]
  verbs: [ "get" ]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: ambassador-projects
  labels:
    product: aes
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ambassador-projects
subjects:
- kind: ServiceAccount
  name: ambassador
  namespace: ambassador

######################################################################
# Redis
---
apiVersion: v1
kind: Service
metadata:
  name: ambassador-redis
  namespace: ambassador
  labels:
    product: aes
spec:
  type: ClusterIP
  ports:
  - port: 6379
    targetPort: 6379
  selector:
    service: ambassador-redis
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ambassador-redis
  namespace: ambassador
  labels:
    product: aes
spec:
  replicas: 1
  selector:
    matchLabels:
      service: ambassador-redis
  template:
    metadata:
      labels:
        service: ambassador-redis
    spec:
      containers:
      - name: redis
        image: redis:5.0.1
      restartPolicy: Always

######################################################################
# Configure Ambassador Edge Stack.
---
apiVersion: getambassador.io/v2
kind: RateLimitService
metadata:
  name: ambassador-edge-stack-ratelimit
  namespace: ambassador
  labels:
    product: aes
spec:
  service: "127.0.0.1:8500"
---
apiVersion: getambassador.io/v2
kind: AuthService
metadata:
  name: ambassador-edge-stack-auth
  namespace: ambassador
  labels:
    product: aes
spec:
  proto: grpc
  status_on_error:
    code: 504
  auth_service: "127.0.0.1:8500"
  allow_request_body: false # setting this to 'true' allows Plugin and External filters to access the body, but has performance overhead
---
apiVersion: v1
kind: Secret
metadata:
  name: ambassador-edge-stack
  namespace: ambassador
data:
  license-key: "" # This secret is just a placeholder, it is mounted as a volume and refreshed when changed

######################################################################
# Configure DevPortal
---
apiVersion: getambassador.io/v2
kind: Mapping
metadata:
  # This Mapping name is referenced by convention, it's important to leave as-is.
  name: ambassador-devportal
  namespace: ambassador
  labels:
    product: aes
spec:
  prefix: /docs/
  rewrite: "/docs/"
  service: "127.0.0.1:8500"
---
# Set up a seperate mapping for the assets so we can inject caching headers to improve page load time
apiVersion: getambassador.io/v2
kind: Mapping
metadata:
  name: ambassador-devportal-assets
  namespace: ambassador
spec:
  prefix: /documentation/(assets|styles)/(.*)(.css)
  prefix_regex: true
  regex_rewrite:
    pattern: /documentation/(.*)
    substitution: /docs/\1
  service: "127.0.0.1:8500"
  add_response_headers:
    cache-control:
      value: "public, max-age=3600, immutable"
      append: false
---
apiVersion: getambassador.io/v2
kind: Mapping
metadata:
  # This Mapping name is referenced by convention, it's important to leave as-is.
  name: ambassador-devportal-api
  namespace: ambassador
  labels:
    product: aes
spec:
  prefix: /openapi/
  rewrite: ""
  service: "127.0.0.1:8500"

######################################################################
# Create the 'ambassador' and 'ambassador-admin' Services.
---
apiVersion: v1
kind: Service
metadata:
  name: ambassador
  namespace: ambassador
  labels:
    product: aes
    app.kubernetes.io/component: ambassador-service
spec:
  type: LoadBalancer
  ports:
  - name: http
    port: 80
    targetPort: http
  - name: https
    port: 443
    targetPort: https
  selector:
    service: ambassador
---
apiVersion: v1
kind: Service
metadata:
  labels:
    service: ambassador-admin
    product: aes
  name: ambassador-admin
  namespace: ambassador
spec:
  type: ClusterIP
  ports:
  - name: ambassador-admin
    port: 8877
    targetPort: admin
  selector:
    service: ambassador

######################################################################
# Create the Deployment backing the 'ambassador' and
# 'ambassador-admin' Services.
---
# AES specific permissions. If a permission also applies to OSS, it should go in ambassador/docs/yaml/ambassador/ambassador-rbac.yaml
# Edge Stack mostly needs the same permissions as Ambassador OSS,
# but:
#  1. It needs extra permissions ("update"/"patch"/"create"/"delete")
#     for getambassador.io resources.
#  2. It needs extra permissions ("create"/"update") for secrets.
#  3. It needs permission to "create" events.
#  4. It needs permission to "get"/"create"/"update" Leases (or
#     Endpoints, if on Kubernetes <1.12).
#
# Note: If you edit this, be sure to also edit the pytest
# `manifests/rbac_*_scope.yaml` files.
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador
  labels:
    product: aes
rules:
- apiGroups: [ "apiextensions.k8s.io" ]
  resources: [ "customresourcedefinitions" ]
  verbs: ["get", "list", "watch"]
- apiGroups: [ "getambassador.io" ]
  resources: [ "*" ]
  verbs: ["update", "patch", "create", "delete" ]
- apiGroups: [""]
  resources: [ "secrets" ]
  verbs: ["create", "update"]
- apiGroups: [""]
  resources: [ "events" ]
  verbs: ["get", "list", "watch", "create", "patch"]
- apiGroups: ["coordination.k8s.io"]
  resources: [ "leases" ]
  verbs: ["get", "create", "update"]
- apiGroups: [""]
  resources: [ "endpoints" ]
  verbs: ["get", "list", "watch", "create", "update"]
- apiGroups:
  - ''
  resources:
  - endpoints
  - namespaces
  - secrets
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - getambassador.io
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - getambassador.io
  resources:
  - mappings/status
  verbs:
  - update
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.internal.knative.dev
  resources:
  - clusteringresses
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.internal.knative.dev
  resources:
  - ingresses/status
  - clusteringresses/status
  verbs:
  - update
- apiGroups:
  - extensions
  - networking.k8s.io
  resources:
  - ingresses
  - ingressclasses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  - networking.k8s.io
  resources:
  - ingresses/status
  verbs:
  - update
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    product: aes
  name: ambassador
  namespace: ambassador
spec:
  replicas: 1
  selector:
    matchLabels:
      service: ambassador
  template:
    metadata:
      annotations:
        consul.hashicorp.com/connect-inject: 'false'
        sidecar.istio.io/inject: 'false'
      labels:
        app.kubernetes.io/managed-by: getambassador.io
        service: ambassador
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchLabels:
                  service: ambassador
              topologyKey: kubernetes.io/hostname
            weight: 100
      containers:
      - env:
        - name: AMBASSADOR_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: REDIS_URL
          value: ambassador-redis:6379
        - name: AMBASSADOR_URL
          value: https://ambassador.ambassador.svc.cluster.local
        - name: POLL_EVERY_SECS
          value: '60'
        - name: AMBASSADOR_INTERNAL_URL
          value: https://127.0.0.1:8443
        - name: AMBASSADOR_SINGLE_NAMESPACE
          value: ''
        - name: AMBASSADOR_DRAIN_TIME
          value: '600'
        image: docker.io/datawire/aes:1.11.2
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /ambassador/v0/check_alive
            port: 8877
          periodSeconds: 3
        name: aes
        ports:
        - containerPort: 8080
          name: http
        - containerPort: 8443
          name: https
        - containerPort: 8877
          name: admin
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /ambassador/v0/check_ready
            port: 8877
          periodSeconds: 3
        resources:
          limits:
            cpu: 1000m
            memory: 600Mi
          requests:
            cpu: 200m
            memory: 300Mi
        securityContext:
          allowPrivilegeEscalation: false
        volumeMounts:
        - mountPath: /tmp/ambassador-pod-info
          name: ambassador-pod-info
        - mountPath: /.config/ambassador
          name: ambassador-edge-stack-secrets
          readOnly: true
      restartPolicy: Always
      securityContext:
        runAsUser: 8888
      serviceAccountName: ambassador
      terminationGracePeriodSeconds: 0
      volumes:
      - downwardAPI:
          items:
          - fieldRef:
              fieldPath: metadata.labels
            path: labels
        name: ambassador-pod-info
      - name: ambassador-edge-stack-secrets
        secret:
          secretName: ambassador-edge-stack
