apiVersion: v1
kind: ConfigMap
metadata:
  name: kube-graffiti-config
  namespace: kube-graffiti
data:
  graffiti-config.yaml: |
    log-level: info
    check-existing: false
    health-checker:
      port: 9999
      path: /am-i-healthy
    server:
      port: 8443
      namespace: kube-graffiti
      service: kube-graffiti
      ca-cert-path: /tls/ca-cert
      cert-path: /tls/server-cert
      key-path: /tls/server-key
    rules:
    - registration:
        name: add-name-label-to-namespaces
        targets:
        - api-groups:
          - ""
          api-versions:
          - v1
          resources:
          - namespaces
        failure-policy: Ignore
      payload:
        additions:
          labels:
            name: '{{ index . "metadata.name" }}'
    - registration:
        name: namespaces-istio-and-kiam
        targets:
        - api-groups:
          - ""
          api-versions:
          - v1
          resources:
          - namespaces
        failure-policy: Ignore
      matchers:
        label-selectors:
        -  "name notin (kube-system,kube-public,default)"
      payload:
        additions:
          labels:
            istio-injection: enabled
          annotations:
            iam.amazonaws.com/permitted: ".*"
    - registration:
        name: mobile-magic-ownership-markers
        targets:
        - api-groups:
          - "*"
          api-versions:
          - "*"
          resources:
          - pods
          - deployments
          - services
          - jobs
          - ingresses
          - secrets
          - configmaps
        namespace-selector: name = mobile-team
        failure-policy: Ignore
      payload:
        additions:
          annotations:
            owner: "Stephanie Jobs"
            security-zone: "alpha"
            contact: "mobileteam@mycorp.com"
            wiki: "http://wiki.mycorp.com/mobile-team"
    - registration:
        name: block-specific-deploy-in-mobile-team
        targets:
        - api-groups:
          - "*"
          api-versions:
          - "*"
          resources:
          - pods
          - deployments
        namespace-selector: name = mobile-team
        failure-policy: Ignore
      matchers:
        field-selectors:
        - spec.template.spec.containers.0.image = nginx
      payload:
        block: true