apiVersion: v1
data:
  config.yaml: |
    ---
    version: v1.0.0
    logger:
      log_path: /var/log/athenz/webhook.log
      log_trace: athenz,server
    server:
      port: 443
      health_check_port: 8080
      health_check_path: /healthz
      timeout: 30s
      shutdown_duration: 10s
      probe_wait_time: 9s
      tls:
        enabled: true
        cert_key: cert
        key_key: key
    athenz:
      auth_header: Athenz-Principal-Auth
      url: https://www.athenz.io:4443/zts/v1
      timeout: 30s
      root_ca: root_ca
    token:
      athenz_domain: _athenz_domain_
      service_name: _service_name_
      ntoken_path: ""
      private_key_env_name: athenz_private_key
      validate_token: false
      refresh_duration: 5s
      key_version: v1.1
      expiration: 5s
    map_rule:
      tld:
        name: garm
        platform:
          name: k8s
          # service_athenz_domain: {{TLD}}.k8s.{{ENV}} # {{ENV}} = [prod, tool, dev]
          service_athenz_domain: k8s.k8s.dev
          resource_mappings:
          verb_mappings:
          api_group_control: true
          api_group_mappings:
            "": "core"
          empty_namespace: allnamespaces
          non_resource_api_group: nonres
          non_resource_namespace: nonres
          resource_name_control: true
          resource_name_mappings:
            "https:kubernetes-dashboard:": "kubernetes-dashboard"
          resource_name_replacer:
            ":": "-"
            "--": "-"
          athenz_user_prefix: user.
          service_account_prefixes:
            - ""
            - ""
          # admin_access_list: # verb.namespace.api_group.resource.name
          #  - verb: *
          #    namespace: kube-system
          #    api_group: '*'
          #    resource: '*'
          #    name: '*'
          #  - verb: *
          #    namespace: allnamespaces
          #    api_group: '*'
          #    resource: '*'
          #    name: '*'
          black_list: # verb.namespace.api_group.resource.name
            - verb: 'get'
              namespace: 'allnamespaces'
              api_group: '*'
              resource: 'secrets'
              name: '*'
            - verb: 'list'
              namespace: 'allnamespaces'
              api_group: '*'
              resource: 'secrets'
              name: '*'
            - verb: '*'
              namespace: 'kube-system'
              api_group: '*'
              resource: '*'
              name: '*'
          white_list: # verb.namespace.api_group.resource.name first
            - verb: 'get'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'configmaps'
              name: '*'
            - verb: 'list'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'configmaps'
              name: '*'
            - verb: 'get'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'services'
              name: '*'
            - verb: 'list'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'services'
              name: '*'
            - verb: 'get'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'services.proxy'
              name: '*'
            - verb: 'get'
              namespace: 'kube-system'
              api_group: 'extensions'
              resource: 'ingresses'
              name: '*'
            - verb: 'list'
              namespace: 'kube-system'
              api_group: 'extensions'
              resource: 'ingresses'
              name: '*'
            - verb: 'update'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'configmaps'
              name: 'grafana-dashboards-extra'
            - verb: 'patch'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'configmaps'
              name: 'grafana-dashboards-extra'
            - verb: 'update'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'configmaps'
              name: 'prometheus-custom-rules'
            - verb: 'patch'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'configmaps'
              name: 'prometheus-custom-rules'
            - verb: 'update'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'configmaps'
              name: 'prometheus-alert-config'
            - verb: 'patch'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'configmaps'
              name: 'prometheus-alert-config'
            - verb: 'update'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'secrets'
              name: 'alertmanager'
            - verb: 'patch'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'secrets'
              name: 'alertmanager'
            - verb: 'get'
              namespace: 'kube-system'
              api_group: '*'
              resource: 'secrets'
              name: 'alertmanager'
            - verb: 'update'
              namespace: 'kube-system'
              api_group: 'rbac.authorization.k8s.io'
              resource: 'rolebindings'
              name: 'k8s-addon-manager-admin'
            - verb: 'patch'
              namespace: 'kube-system'
              api_group: 'rbac.authorization.k8s.io'
              resource: 'rolebindings'
              name: 'k8s-addon-manager-admin'
            - verb: 'get'
              namespace: 'kube-system'
              api_group: 'rbac.authorization.k8s.io'
              resource: 'rolebindings'
              name: 'k8s-addon-manager-admin'
          admin_athenz_domain: k8s.caas.system-role
kind: ConfigMap
metadata:
  name: garm-config
  namespace: kube-public
  selfLink: /api/v1/namespaces/kube-public/configmaps/garm-config
