deploy-mwh.yaml

apiVersion: v1
kind: Secret
metadata:
  name: webhook-tls-certificates
type: Opaque
data:
  username: YWRtaW4=
  password: MWYyZDFlMmU2N2Rm
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: test-mwh:namespace-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin
subjects:
- kind: ServiceAccount
  name: test-mwh 
  apiGroup: ""
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: test-mwh:namespaceperms
rules:
- apiGroups: [""]
  resources: ["namespaces","secrets","services","configmaps","endpoints","persistentvolumeclaims","pods","pods/attach","pods/exec","pods/portforward","pods/proxy","replicationcontrollers","replicationcontrollers/scale","serviceaccounts","services/proxy"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["apps"]
  resources: ["daemonsets","deployments","deployments/rollback","deployments/scale","replicasets","replicasets/scale","statefulsets","statefulsets/scale"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["extensions"]
  resources: ["daemonsets","deployments","deployments/rollback","deployments/scale","ingresses","networkpolicies","replicasets","replicasets/scale","replicationcontrollers/scale"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses","networkpolicies"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["policy"]
  resources: ["poddisruptionbudgets"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["rolebindings","roles"]
  verbs: ["get","list","create","update","delete","watch","patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: test-mwh:namespaceperms-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: test-mwh:namespaceperms
subjects:
- kind: ServiceAccount
  name: test-mwh 
  namespace: "default"
  apiGroup: ""
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: test-mwh:clusterperms
rules:
- apiGroups: ["certificates.k8s.io"]
  resources: ["certificatesigningrequests","certificatesigningrequests/approval"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["certificates.k8s.io"]
  resources: ["signers"]
  resourceNames: ["kubernetes.io/legacy-unknown","kubernetes.io/kubelet-serving","kubernetes.io/kube-apiserver-client","cloudark.io/kubeplus"]
  verbs: ["approve"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: [""]
  resources: ["endpoints"]
  verbs: ["get","list","watch"]
- apiGroups: ["admissionregistration.k8s.io"]
  resources: ["mutatingwebhookconfigurations"]
  verbs: ["get","list","create","delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles"]
  verbs: ["get","list","create","delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterrolebindings"]
  verbs: ["get","list","create","delete"]
- apiGroups: ["","*","rbac.authorization.k8s.io","platformapi.kubeplus","networking.k8s.io","autoscaling"]
  resources: ["*","groups","pods/portforward","serviceaccounts","users","pods/exec","horizontalpodautoscalers","networkpolicies","clusterrolebindings","clusterroles"]
  verbs: ["get","list","watch","impersonate","create","delete","update","patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: test-mwh:allperms
rules:
        #- apiGroups: ["*"]
        #  resources: ["*"]
        #  verbs: ["get","list","create","update","delete","watch","patch","impersonate"]
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["patch"]
- apiGroups: ["certificates.k8s.io"]
  resources: ["certificatesigningrequests","certificatesigningrequests/approval"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["certificates.k8s.io"]
  resources: ["signers"]
  resourceNames: ["kubernetes.io/legacy-unknown","kubernetes.io/kubelet-serving","kubernetes.io/kube-apiserver-client","cloudark.io/kubeplus"]
  verbs: ["approve"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: [""]
  resources: ["endpoints"]
  verbs: ["get","list","watch"]
- apiGroups: ["admissionregistration.k8s.io"]
  resources: ["mutatingwebhookconfigurations"]
  verbs: ["get","list","create","delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles"]
  verbs: ["get","list","create","delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterrolebindings"]
  verbs: ["get","list","create","delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles"]
  verbs: ["get","list","update","delete","create"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["rolebindings"]
  verbs: ["get","list","create","delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: test-mwh:allperms-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: test-mwh:allperms
subjects:
- kind: ServiceAccount
  name: test-mwh 
  namespace: "default"
  apiGroup: ""
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: test-mwh:readallperms
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get","list","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: test-mwh:readallperms-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: test-mwh:readallperms
subjects:
- kind: ServiceAccount
  name: test-mwh 
  namespace: "default"
  apiGroup: ""
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: test-mwh:providerapiperms
rules:
- apiGroups: ["workflows.kubeplus"]
  resources: ["resourcecompositions","resourceevents","resourcemonitors","resourcepolicies"]
  verbs: ["get","list","create","update","delete","watch","patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: test-mwh:providerapiperms-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: test-mwh:providerapiperms
subjects:
- kind: ServiceAccount
  name: test-mwh 
  namespace: "default"
  apiGroup: ""
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kubeplus-saas-provider-consumer
rules:
- apiGroups: ["platformapi.kubeplus"]
  resources: ["*"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: [""]
  resources: ["pods/portforward"]
  verbs: ["get","list","create","update","delete","watch","patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubeplus-saas-provider-consumer-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubeplus-saas-provider-consumer
subjects:
- kind: ServiceAccount
  name: test-mwh 
  namespace: "default"
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: test-mwh 
  namespace: "default"
---
apiVersion: v1
kind: Service
metadata:
  name: crd-hook-service
  namespace: "default"
  labels:
    app: crd-hook-service
spec:
  ports:
  - port: 443
    targetPort: 443
  selector:
    app: kubeplus
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-mwh-deployment # do not change
  namespace: "default"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kubeplus
  template:
    metadata:
      name: kubeplus
      labels:
        app: kubeplus
    spec:
      serviceAccount: test-mwh 
      initContainers:
      - name: mwh-setup
        image: mwh-setup:latest
        imagePullPolicy: IfNotPresent 
        env:
          - name: KUBEPLUS_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        command: ["./webhook-create-self-signed-ca-cert.sh"]
        args:
          - "--service"
          - "crd-hook-service"
          - "--namespace"
          - "$(KUBEPLUS_NAMESPACE)"
          - "--secret"
          - "webhook-tls-certificates"
      containers:
      - name: crd-hook
        image: mwh:latest
        imagePullPolicy: IfNotPresent 
        args:
          - -tlsCertFile=/etc/webhook/certs/cert.pem
          - -tlsKeyFile=/etc/webhook/certs/key.pem
          - -alsologtostderr
          #- -v=4
          - 2>&1
        volumeMounts:
        - name: webhook-certs
          mountPath: /etc/webhook/certs
          readOnly: true
      volumes:
        - name: webhook-certs
          secret:
            secretName: webhook-tls-certificates
---