---
apiVersion: v1
kind: ConfigMap
metadata:
  name: chaostoolkit-resources-templates
data:
  chaostoolkit-ns.yaml: |-
    apiVersion: v1
    kind: Namespace
    metadata:
      name: chaostoolkit-run

  chaostoolkit-sa.yaml: |-
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: chaostoolkit

  chaostoolkit-role.yaml: |-
    apiVersion: rbac.authorization.k8s.io/v1
    kind: Role
    metadata:
      name: chaostoolkit-experiment
    rules:
    - apiGroups:
      - ""
      resources:
      - pods
      verbs:
      - "create"
      - "get"
      - "delete"
      - "list"

  chaostoolkit-role-psp-rule.yaml: |-
    apiGroups:
    - policy
    - extensions
    resources:
    - podsecuritypolicies
    resourceNames:
    - chaostoolkit-run
    verbs:
    - use

  chaostoolkit-role-binding.yaml: |-
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      name: chaostoolkit-experiment
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: Role
      name: chaostoolkit-experiment
    subjects:
    - kind: ServiceAccount
      name: chaostoolkit
      namespace: chaostoolkit-run

  chaostoolkit-pod.yaml: |-
    apiVersion: v1
    kind: Pod
    metadata:
      name: chaostoolkit
      labels:
        app: chaostoolkit
    spec:
      restartPolicy: Never
      serviceAccountName: chaostoolkit
      containers:
      - name: chaostoolkit
        image: chaostoolkit/chaostoolkit
        imagePullPolicy: Always
        command:
        - /usr/local/bin/chaos
        args:
        - run
        - $(EXPERIMENT_PATH)
        env:
        - name: CHAOSTOOLKIT_IN_POD
          value: "true"
        - name: EXPERIMENT_PATH
          value: "/home/svc/experiment.json"
        envFrom:
        - configMapRef:
            name: chaostoolkit-env
        resources:
          limits:
            cpu: 100m
            memory: 128Mi
          requests:
            cpu: 100m
            memory: 128Mi
        volumeMounts:
        - name: chaostoolkit-settings
          mountPath: /home/svc/.chaostoolkit/
          readOnly: true
        - name: chaostoolkit-experiment
          mountPath: /home/svc/experiment.json
          subPath: experiment.json
          readOnly: true
      volumes:
      - name: chaostoolkit-settings
        secret:
          secretName: chaostoolkit-settings
      - name: chaostoolkit-experiment
        configMap:
          name: chaostoolkit-experiment

  chaostoolkit-cronjob.yaml: |-
    apiVersion: batch/v1beta1
    kind: CronJob
    metadata:
      name: chaostoolkit
      labels:
        app: chaostoolkit
    spec:
      schedule: "* * * * *"
      jobTemplate:
        metadata:
          labels:
            app: chaostoolkit
        spec:
          template:
            metadata:
              labels:
                app: chaostoolkit
            spec:
