apiVersion: v1
data:
  baetyl-core-app.yml: |-
    name: "{{.CoreAppName}}"
    namespace: "{{.Namespace}}"
    selector: "baetyl-node-name={{.NodeName}}"
    labels:
      baetyl-cloud-system: "true"
    type: "container"
    system: true
    services:
      - name: "baetyl-core"
        image: "{{GetProperty "baetyl-image"}}"
        replica: 1
        args:
          - "core"
        volumeMounts:
          - name: "core-conf"
            mountPath: "/etc/baetyl"
            readOnly: true
          - name: "node-cert"
            mountPath: "/var/lib/baetyl/node"
          - name: "core-store-path"
            mountPath: "/var/lib/baetyl/store"
          - name: "object-download-path"
            mountPath: "/var/lib/baetyl/object"
          - name: "host-root-path"
            mountPath: "/var/lib/baetyl/host"
        ports:
          - containerPort: 80
            hostPort: 30050
            protocol: "TCP"
    volumes:
      - name: "core-conf"
        config:
          name: "{{.CoreConfName}}"
          version: "{{.CoreConfVersion}}"
      - name: "node-cert"
        secret:
          name: "{{.NodeCertName}}"
          version: "{{.NodeCertVersion}}"
      - name: "core-store-path"
        hostPath:
          path: "{{.BAETYL_HOST_PATH_LIB}}/store"
      - name: "object-download-path"
        hostPath:
          path: "{{.BAETYL_HOST_PATH_LIB}}/object"
      - name: "host-root-path"
        hostPath:
          path: "{{.BAETYL_HOST_PATH_LIB}}/host"
  baetyl-core-conf.yml: |-
    name: "{{.CoreConfName}}"
    namespace: "{{.Namespace}}"
    system: true
    labels:
      baetyl-app-name: "{{.CoreAppName}}"
      baetyl-node-name: "{{.NodeName}}"
      baetyl-cloud-system: "true"
    data:
      conf.yml: |-
        node:
          ca: var/lib/baetyl/node/ca.pem
          key: var/lib/baetyl/node/client.key
          cert: var/lib/baetyl/node/client.pem
        httplink:
          address: "{{GetProperty "sync-server-address"}}"
          insecureSkipVerify: true
        logger:
          level: debug
  baetyl-function-app.yml: |-
    name: "{{.FunctionAppName}}"
    namespace: "{{.Namespace}}"
    selector: "baetyl-node-name={{.NodeName}}"
    labels:
      baetyl-cloud-system: "true"
    type: "container"
    system: true
    services:
      - name: "baetyl-function"
        image: "{{GetProperty "baetyl-function-image"}}"
        replica: 1
        volumeMounts:
          - name: "func-conf"
            mountPath: "/etc/baetyl"
            readOnly: true
        ports:
          - containerPort: 80
            protocol: "TCP"
    volumes:
      - name: "func-conf"
        config:
          name: "{{.FunctionConfName}}"
          version: "{{.FunctionConfVersion}}"
  baetyl-function-conf.yml: |-
    name: "{{.FunctionConfName}}"
    namespace: "{{.Namespace}}"
    system: true
    labels:
      baetyl-app-name: "{{.FunctionAppName}}"
      baetyl-node-name: "{{.NodeName}}"
      baetyl-cloud-system: "true"
    data:
      conf.yml: |-
        logger:
          level: debug
  baetyl-init-deployment.yml: |-
    kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: system:aggregated-metrics-reader
      labels:
        rbac.authorization.k8s.io/aggregate-to-view: "true"
        rbac.authorization.k8s.io/aggregate-to-edit: "true"
        rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rules:
      - apiGroups: ["metrics.k8s.io"]
        resources: ["pods", "nodes"]
        verbs: ["get", "list", "watch"]
    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRoleBinding
    metadata:
      name: metrics-server:system:auth-delegator
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: system:auth-delegator
    subjects:
      - kind: ServiceAccount
        name: metrics-server
        namespace: kube-system
    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: RoleBinding
    metadata:
      name: metrics-server-auth-reader
      namespace: kube-system
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: Role
      name: extension-apiserver-authentication-reader
    subjects:
      - kind: ServiceAccount
        name: metrics-server
        namespace: kube-system
    ---
    apiVersion: apiregistration.k8s.io/v1beta1
    kind: APIService
    metadata:
      name: v1beta1.metrics.k8s.io
    spec:
      service:
        name: metrics-server
        namespace: kube-system
      group: metrics.k8s.io
      version: v1beta1
      insecureSkipTLSVerify: true
      groupPriorityMinimum: 100
      versionPriority: 100
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: metrics-server
      namespace: kube-system
    ---
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: metrics-server
      namespace: kube-system
      labels:
        k8s-app: metrics-server
    spec:
      selector:
        matchLabels:
          k8s-app: metrics-server
      template:
        metadata:
          name: metrics-server
          labels:
            k8s-app: metrics-server
        spec:
          serviceAccountName: metrics-server
          volumes:
            # mount in tmp so we can safely use from-scratch images and/or read-only containers
            - name: tmp-dir
              emptyDir: {}
          containers:
            - name: metrics-server
              image: 'rancher/metrics-server:v0.3.6'
              imagePullPolicy: IfNotPresent
              command:
                - /metrics-server
                - --kubelet-insecure-tls
                - --kubelet-preferred-address-types=InternalDNS,InternalIP,ExternalDNS,ExternalIP,Hostname
              volumeMounts:
                - name: tmp-dir
                  mountPath: /tmp
    ---
    apiVersion: v1
    kind: Service
    metadata:
      name: metrics-server
      namespace: kube-system
      labels:
        kubernetes.io/name: "Metrics-server"
        kubernetes.io/cluster-service: "true"
    spec:
      selector:
        k8s-app: metrics-server
      ports:
        - port: 443
          protocol: TCP
          targetPort: 443
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: system:metrics-server
    rules:
      - apiGroups:
          - ""
        resources:
          - pods
          - nodes
          - nodes/stats
          - namespaces
        verbs:
          - get
          - list
          - watch
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: system:metrics-server
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: system:metrics-server
    subjects:
      - kind: ServiceAccount
        name: metrics-server
        namespace: kube-system
    ---
    apiVersion: v1
    kind: Namespace
    metadata:
      name: local-path-storage
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: local-path-provisioner-service-account
      namespace: local-path-storage
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: local-path-provisioner-role
    rules:
      - apiGroups: [""]
        resources: ["nodes", "persistentvolumeclaims"]
        verbs: ["get", "list", "watch"]
      - apiGroups: [""]
        resources: ["endpoints", "persistentvolumes", "pods"]
        verbs: ["*"]
      - apiGroups: [""]
        resources: ["events"]
        verbs: ["create", "patch"]
      - apiGroups: ["storage.k8s.io"]
        resources: ["storageclasses"]
        verbs: ["get", "list", "watch"]
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: local-path-provisioner-bind
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: local-path-provisioner-role
    subjects:
      - kind: ServiceAccount
        name: local-path-provisioner-service-account
        namespace: local-path-storage
    ---
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: local-path-provisioner
      namespace: local-path-storage
    spec:
      replicas: 1
      selector:
        matchLabels:
          app: local-path-provisioner
      template:
        metadata:
          labels:
            app: local-path-provisioner
        spec:
          serviceAccountName: local-path-provisioner-service-account
          containers:
            - name: local-path-provisioner
              image: rancher/local-path-provisioner:v0.0.12
              imagePullPolicy: IfNotPresent
              command:
                - local-path-provisioner
                - --debug
                - start
                - --config
                - /etc/config/config.json
              volumeMounts:
                - name: config-volume
                  mountPath: /etc/config/
              env:
                - name: POD_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.namespace
          volumes:
            - name: config-volume
              configMap:
                name: local-path-config
    ---
    apiVersion: storage.k8s.io/v1
    kind: StorageClass
    metadata:
      name: local-path
    provisioner: rancher.io/local-path
    volumeBindingMode: WaitForFirstConsumer
    reclaimPolicy: Delete
    ---
    kind: ConfigMap
    apiVersion: v1
    metadata:
      name: local-path-config
      namespace: local-path-storage
    data:
      config.json: |-
        {
                "nodePathMap":[
                {
                        "node":"DEFAULT_PATH_FOR_NON_LISTED_NODES",
                        "paths":["/opt/local-path-provisioner"]
                }]
        }
    ---
    apiVersion: v1
    kind: Namespace
    metadata:
      name: {{.EdgeSystemNamespace}}

    ---
    apiVersion: v1
    kind: Namespace
    metadata:
      name: {{.EdgeNamespace}}

    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: baetyl-edge-system-service-account
      namespace: {{.EdgeSystemNamespace}}

    ---
    # elevation of authority
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRoleBinding
    metadata:
      name: baetyl-edge-system-rbac
    subjects:
      - kind: ServiceAccount
        name: baetyl-edge-system-service-account
        namespace: {{.EdgeSystemNamespace}}
    roleRef:
      kind: ClusterRole
      name: cluster-admin
      apiGroup: rbac.authorization.k8s.io

    ---
    kind: StorageClass
    apiVersion: storage.k8s.io/v1
    metadata:
      name: local-storage
    provisioner: kubernetes.io/no-provisioner
    volumeBindingMode: WaitForFirstConsumer

    ---
    apiVersion: v1
    kind: Secret
    metadata:
      name: {{.NodeCertName}}
      namespace: {{.EdgeSystemNamespace}}
    type: Opaque
    data:
      client.pem: '{{.NodeCertPem}}'
      client.key: '{{.NodeCertKey}}'
      ca.pem: '{{.NodeCertCa}}'

    ---
    # baetyl-init configmap
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: baetyl-init-config
      namespace: {{.EdgeSystemNamespace}}
    data:
      conf.yml: |-
        node:
          ca: var/lib/baetyl/node/ca.pem
          key: var/lib/baetyl/node/client.key
          cert: var/lib/baetyl/node/client.pem
        httplink:
          address: {{GetProperty "sync-server-address"}}
          insecureSkipVerify: true
        logger:
          level: debug
          encoding: console

    ---
    # baetyl-init deployment
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: baetyl-init
      namespace: {{.EdgeSystemNamespace}}
      labels:
        baetyl-app-name: baetyl-init
        baetyl-service-name: baetyl-init
    spec:
      selector:
        matchLabels:
          baetyl-service-name: baetyl-init
      replicas: 1
      template:
        metadata:
          labels:
            baetyl-app-name: baetyl-init
            baetyl-service-name: baetyl-init
        spec:
          nodeName: {{.KubeNodeName}}
          serviceAccountName: baetyl-edge-system-service-account
          containers:
            - name: baetyl-init
              image: {{GetProperty "baetyl-image"}}
              imagePullPolicy: IfNotPresent
              args:
                - init
              env:
                - name: KUBE_NODE_NAME
                  valueFrom:
                    fieldRef:
                      fieldPath: spec.nodeName
              volumeMounts:
                - name: init-conf
                  mountPath: /etc/baetyl
                - name: core-store-path
                  mountPath: /var/lib/baetyl/store
                - name: object-download-path
                  mountPath: /var/lib/baetyl/object
                - name: host-root-path
                  mountPath: /var/lib/baetyl/host
                - name: node-cert
                  mountPath: /var/lib/baetyl/node
          volumes:
            - name: init-conf
              configMap:
                name: baetyl-init-config
            - name: core-store-path
              hostPath:
                path: /var/lib/baetyl/store
            - name: object-download-path
              hostPath:
                path: /var/lib/baetyl/object
            - name: host-root-path
              hostPath:
                path: /var/lib/baetyl/host
            - name: node-cert
              secret:
                secretName: {{.NodeCertName}}
kind: ConfigMap
metadata:
  name: baetyl-cloud-templates
  namespace: default
