kubit.yml

{{- if not .Values.skipOperator}}
{{- if not .Values.kubitSingleNamespace}}
apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/component: manager
    app.kubernetes.io/instance: kubit
    app.kubernetes.io/name: namespace
    app.kubernetes.io/part-of: kubit
    control-plane: kubit
  name: kubit
---
{{- end}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kubit
  namespace: {{if .Values.kubitSingleNamespace}}{{.Values.namespaceOverride | default .Release.Namespace}}{{else}}kubit{{end}}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: {{if .Values.kubitSingleNamespace}}Role{{else}}ClusterRole{{end}}
metadata:
  name: kubit
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - create
  - update
  - get
  - list
  - patch
  - watch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: {{if .Values.kubitSingleNamespace}}RoleBinding{{else}}ClusterRoleBinding{{end}}
metadata:
  name: kubit
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: {{if .Values.kubitSingleNamespace}}Role{{else}}ClusterRole{{end}}
  name: kubit
subjects:
- kind: ServiceAccount
  name: kubit
  namespace: {{if .Values.kubitSingleNamespace}}{{.Values.namespaceOverride | default .Release.Namespace}}{{else}}kubit{{end}}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: manager
    app.kubernetes.io/instance: kubit
    app.kubernetes.io/name: deployment
    app.kubernetes.io/part-of: kubit
    control-plane: kubit
  name: kubit
  namespace: {{if .Values.kubitSingleNamespace}}{{.Values.namespaceOverride | default .Release.Namespace}}{{else}}kubit{{end}}
spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: kubit
  strategy:
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: manager
      labels:
        control-plane: kubit
    spec:
      containers:
      - env:
{{- if .Values.kubitSingleNamespace}}
        - name: KUBIT_WATCHED_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
{{- end}}
        - name: KUBIT_CONTROLLER_IMAGE
          value: "{{.Values.operatorImageOverride | default "ghcr.io/kubecfg/kubit"}}:{{.Values.operatorImageVersion}}"
{{- if .Values.kubit.apply_step_image}}
        - name: KUBIT_APPLY_STEP_KUBECTL_IMAGE
          value: "{{.Values.kubit.apply_step_image}}"
{{- end}}
{{- if .Values.kubit.render_step_image}}
        - name: KUBIT_RENDER_STEP_KUBECTL_IMAGE
          value: "{{.Values.kubit.render_step_image}}"
{{- end}}
{{- if .Values.kubit.kubecfg_image}}
        - name: KUBIT_KUBECFG_IMAGE
          value: "{{.Values.kubit.kubecfg_image}}"
{{- end}}
        image: "{{.Values.operatorImageOverride | default "ghcr.io/kubecfg/kubit"}}:{{.Values.operatorImageVersion}}"
        livenessProbe:
          httpGet:
            path: /live
            port: 8080
          initialDelaySeconds: 15
          periodSeconds: 20
        name: manager
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 10
        {{- $default_kubit_resources := dict
              "requests" (dict "cpu" "50m" "memory" "64Mi")
              "limits"   (dict "cpu" "100m" "memory" "128Mi") -}}
        {{- $kubit_resources := mergeOverwrite $default_kubit_resources (.Values.kubit.resources | default dict) -}}
        resources: {{ $kubit_resources | include "mapTrim" | trim | nindent 10 }}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: kubit
      terminationGracePeriodSeconds: 10
  {{end}}