manifests.yaml

apiVersion: v1
kind: Namespace
metadata:
  labels:
    control-plane: platform-operator
  name: platform-platform-system
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    cert-manager.io/inject-ca-from: platform-system/platform-serving-cert
    controller-gen.kubebuilder.io/version: v0.4.0
  creationTimestamp: null
  name: clusterresourcequotas.platform.flanksource.com
spec:
  group: platform.flanksource.com
  names:
    kind: ClusterResourceQuota
    listKind: ClusterResourceQuotaList
    plural: clusterresourcequotas
    singular: clusterresourcequota
  scope: Cluster
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: ClusterResourceQuota is the Schema for the clusterresourcequotas
          API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: Spec defines the desired quota
            properties:
              quota:
                description: Quota sets aggregate quota restrictions enforced across
                  all namespaces
                properties:
                  hard:
                    additionalProperties:
                      anyOf:
                      - type: integer
                      - type: string
                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                      x-kubernetes-int-or-string: true
                    description: 'hard is the set of desired hard limits for each
                      named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/'
                    type: object
                  scopeSelector:
                    description: scopeSelector is also a collection of filters like
                      scopes that must match each object tracked by a quota but expressed
                      using ScopeSelectorOperator in combination with possible values.
                      For a resource to match, both scopes AND scopeSelector (if specified
                      in spec), must be matched.
                    properties:
                      matchExpressions:
                        description: A list of scope selector requirements by scope
                          of the resources.
                        items:
                          description: A scoped-resource selector requirement is a
                            selector that contains values, a scope name, and an operator
                            that relates the scope name and values.
                          properties:
                            operator:
                              description: Represents a scope's relationship to a
                                set of values. Valid operators are In, NotIn, Exists,
                                DoesNotExist.
                              type: string
                            scopeName:
                              description: The name of the scope that the selector
                                applies to.
                              type: string
                            values:
                              description: An array of string values. If the operator
                                is In or NotIn, the values array must be non-empty.
                                If the operator is Exists or DoesNotExist, the values
                                array must be empty. This array is replaced during
                                a strategic merge patch.
                              items:
                                type: string
                              type: array
                          required:
                          - operator
                          - scopeName
                          type: object
                        type: array
                    type: object
                  scopes:
                    description: A collection of filters that must match each object
                      tracked by a quota. If not specified, the quota matches all
                      objects.
                    items:
                      description: A ResourceQuotaScope defines a filter that must
                        match each object tracked by a quota
                      type: string
                    type: array
                type: object
            type: object
          status:
            description: Status defines the actual enforced quota and its current
              usage
            properties:
              namespaces:
                description: Slices the quota used per namespace
                items:
                  description: ResourceQuotaStatusByNamespace gives status for a particular
                    name
                  properties:
                    namespace:
                      description: Namespace the project this status applies to
                      type: string
                    status:
                      description: Status indicates how many resources have been consumed
                        by this project
                      properties:
                        hard:
                          additionalProperties:
                            anyOf:
                            - type: integer
                            - type: string
                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                            x-kubernetes-int-or-string: true
                          description: 'Hard is the set of enforced hard limits for
                            each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/'
                          type: object
                        used:
                          additionalProperties:
                            anyOf:
                            - type: integer
                            - type: string
                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                            x-kubernetes-int-or-string: true
                          description: Used is the current observed total usage of
                            the resource in the namespace.
                          type: object
                      type: object
                  required:
                  - namespace
                  - status
                  type: object
                type: array
              total:
                description: Total defines the actual enforced quota and its current
                  usage across all namespaces
                properties:
                  hard:
                    additionalProperties:
                      anyOf:
                      - type: integer
                      - type: string
                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                      x-kubernetes-int-or-string: true
                    description: 'Hard is the set of enforced hard limits for each
                      named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/'
                    type: object
                  used:
                    additionalProperties:
                      anyOf:
                      - type: integer
                      - type: string
                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                      x-kubernetes-int-or-string: true
                    description: Used is the current observed total usage of the resource
                      in the namespace.
                    type: object
                type: object
            required:
            - namespaces
            type: object
        type: object
    served: true
    storage: true
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: platform-system/platform-serving-cert
  creationTimestamp: null
  name: platform-mutating-webhook-configuration
  namespace: platform-system
webhooks:
- clientConfig:
    caBundle: Cg==
    service:
      name: platform-operator
      namespace: platform-system
      path: /mutate-v1-ingress
  failurePolicy: Ignore
  name: annotate-ingress-v1.platform.flanksource.com
  rules:
  - apiGroups:
    - extensions
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - ingresses
- clientConfig:
    caBundle: Cg==
    service:
      name: platform-operator
      namespace: platform-system
      path: /mutate-v1-pod
  failurePolicy: Ignore
  name: annotate-pods-v1.platform.flanksource.com
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - pods
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: platform-system/platform-serving-cert
  creationTimestamp: null
  name: platform-validating-webhook-configuration
  namespace: platform-system
webhooks:
- clientConfig:
    caBundle: Cg==
    service:
      name: platform-operator
      namespace: platform-system
      path: /validate-clusterresourcequota-platform-flanksource-com-v1
  failurePolicy: Fail
  name: clusterresourcequotas-validation-v1.platform.flanksource.com
  rules:
  - apiGroups:
    - platform.flanksource.com
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - clusterresourcequotas
- clientConfig:
    caBundle: Cg==
    service:
      name: platform-operator
      namespace: platform-system
      path: /validate-resourcequota-v1
  failurePolicy: Fail
  name: resourcequotas-validation-v1.platform.flanksource.com
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - resourcequotas
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: platform-operator
  namespace: platform-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: platform-leader-election
  namespace: platform-system
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - configmaps/status
  verbs:
  - get
  - update
  - patch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: platform-clusterresourcequota-editor
rules:
- apiGroups:
  - platform.flanksource.com
  resources:
  - clusterresourcequotas
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - platform.flanksource.com
  resources:
  - clusterresourcequotas/status
  verbs:
  - get
  - patch
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: platform-clusterresourcequota-viewer
rules:
- apiGroups:
  - platform.flanksource.com
  resources:
  - clusterresourcequotas
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - platform.flanksource.com
  resources:
  - clusterresourcequotas/status
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: platform-manager
rules:
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - delete
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - resourcequotas
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
  - get
  - list
  - update
- apiGroups:
  - extensions
  resources:
  - ingresses
  verbs:
  - get
  - list
  - update
  - watch
- apiGroups:
  - platform.flanksource.com
  resources:
  - clusterresourcequotas
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - platform.flanksource.com
  resources:
  - clusterresourcequotas/status
  verbs:
  - get
  - patch
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: platform-leader-election
  namespace: platform-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: platform-leader-election
subjects:
- kind: ServiceAccount
  name: platform-operator
  namespace: platform-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: platform-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: platform-manager
subjects:
- kind: ServiceAccount
  name: platform-operator
  namespace: platform-system
---
apiVersion: v1
kind: Service
metadata:
  name: platform-operator
  namespace: platform-system
spec:
  ports:
  - port: 443
    targetPort: 9443
  selector:
    control-plane: platform-operator
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    control-plane: platform-operator
  name: platform-operator
  namespace: platform-system
spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: platform-operator
  template:
    metadata:
      labels:
        control-plane: platform-operator
    spec:
      containers:
      - args:
        - --enable-leader-election
        - --annotations=foo.flanksource.com/bar,foo.flanksource.com/baz
        command:
        - /manager
        image: docker.io/flanksource/platform-operator:latest
        imagePullPolicy: Always
        name: manager
        ports:
        - containerPort: 9443
          name: webhook-server
          protocol: TCP
        resources:
          limits:
            cpu: 100m
            memory: 30Mi
          requests:
            cpu: 100m
            memory: 20Mi
        volumeMounts:
        - mountPath: /tmp/k8s-webhook-server/serving-certs
          name: cert
          readOnly: true
      serviceAccountName: platform-operator
      terminationGracePeriodSeconds: 10
      volumes:
      - name: cert
        secret:
          defaultMode: 420
          secretName: platform-operator
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: platform-serving-cert
  namespace: platform-system
spec:
  dnsNames:
  - platform-operator.platform-system.svc
  - platform-operator.platform-system.svc.cluster.local
  issuerRef:
    kind: Issuer
    name: platform-selfsigned-issuer
  secretName: platform-operator
---
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: platform-selfsigned-issuer
  namespace: platform-system
spec:
  selfSigned: {}