---
apiVersion: v1
data:
  openstack-cloud-controller.yaml: |+
    apiVersion: v1
    items:
    - apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        name: system:cloud-controller-manager
      rules:
      - apiGroups:
        - coordination.k8s.io
        resources:
        - leases
        verbs:
        - get
        - create
        - update
      - apiGroups:
        - ""
        resources:
        - events
        verbs:
        - create
        - patch
        - update
      - apiGroups:
        - ""
        resources:
        - nodes
        verbs:
        - '*'
      - apiGroups:
        - ""
        resources:
        - nodes/status
        verbs:
        - patch
      - apiGroups:
        - ""
        resources:
        - services
        verbs:
        - list
        - patch
        - update
        - watch
      - apiGroups:
        - ""
        resources:
        - serviceaccounts
        verbs:
        - create
        - get
      - apiGroups:
        - ""
        resources:
        - serviceaccounts/token
        verbs:
        - create
      - apiGroups:
        - ""
        resources:
        - persistentvolumes
        verbs:
        - '*'
      - apiGroups:
        - ""
        resources:
        - endpoints
        verbs:
        - create
        - get
        - list
        - watch
        - update
      - apiGroups:
        - ""
        resources:
        - configmaps
        verbs:
        - get
        - list
        - watch
      - apiGroups:
        - ""
        resources:
        - secrets
        verbs:
        - list
        - get
        - watch
    - apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        name: system:cloud-node-controller
      rules:
      - apiGroups:
        - ""
        resources:
        - nodes
        verbs:
        - '*'
      - apiGroups:
        - ""
        resources:
        - nodes/status
        verbs:
        - patch
      - apiGroups:
        - ""
        resources:
        - events
        verbs:
        - create
        - patch
        - update
    kind: List
    metadata: {}
    ---
    apiVersion: v1
    items:
    - apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        name: system:cloud-node-controller
      roleRef:
        apiGroup: rbac.authorization.k8s.io
        kind: ClusterRole
        name: system:cloud-node-controller
      subjects:
      - kind: ServiceAccount
        name: cloud-node-controller
        namespace: kube-system
    - apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        name: system:cloud-controller-manager
      roleRef:
        apiGroup: rbac.authorization.k8s.io
        kind: ClusterRole
        name: system:cloud-controller-manager
      subjects:
      - kind: ServiceAccount
        name: cloud-controller-manager
        namespace: kube-system
    kind: List
    metadata: {}
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: cloud-controller-manager
      namespace: kube-system
    ---
    apiVersion: apps/v1
    kind: DaemonSet
    metadata:
      name: openstack-cloud-controller-manager
      namespace: kube-system
      labels:
        k8s-app: openstack-cloud-controller-manager
    spec:
      selector:
        matchLabels:
          k8s-app: openstack-cloud-controller-manager
      updateStrategy:
        type: RollingUpdate
      template:
        metadata:
          labels:
            k8s-app: openstack-cloud-controller-manager
        spec:
          nodeSelector:
            node-role.kubernetes.io/master: ""
          securityContext:
            runAsUser: 0
          tolerations:
          - key: node.cloudprovider.kubernetes.io/uninitialized
            value: "true"
            effect: NoSchedule
          - key: node-role.kubernetes.io/master
            effect: NoSchedule
          serviceAccountName: cloud-controller-manager
          containers:
          - name: openstack-cloud-controller-manager
            image: docker.io/k8scloudprovider/openstack-cloud-controller-manager:latest
            args:
            - /bin/openstack-cloud-controller-manager
            - --v=1
            - --cloud-config=$(CLOUD_CONFIG)
            - --cloud-provider=openstack
            - --use-service-account-credentials=true
            - --bind-address=127.0.0.1
            volumeMounts:
            - mountPath: /etc/kubernetes/pki
              name: k8s-certs
              readOnly: true
            - mountPath: /etc/ssl/certs
              name: ca-certs
              readOnly: true
            - name: cloud-config-volume
              mountPath: /etc/config/cloud.conf
              mountPropagation: HostToContainer
            resources:
              requests:
                cpu: 200m
            env:
            - name: CLOUD_CONFIG
              value: /etc/config/cloud.conf
          hostNetwork: true
          volumes:
          - hostPath:
              path: /etc/kubernetes/pki
              type: DirectoryOrCreate
            name: k8s-certs
          - hostPath:
              path: /etc/ssl/certs
              type: DirectoryOrCreate
            name: ca-certs
          - name: cloud-config-volume
            hostPath:
              path: /etc/kubernetes/openstack-cloud.conf
              type: File
kind: ConfigMap
metadata:
  name: controller-openstack
  namespace: openstack