apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: sidecar-injector-webhook-cfg
  labels:
    app: sidecar-injector
webhooks:
  - name: sidecar-injector.pingcap.net
    clientConfig:
      service:
        name: sidecar-injector-webhook-svc
        namespace: ${NAMESPACE}
        path: "/mutate"
      caBundle: ${CA_BUNDLE}
    rules:
      - operations: [ "CREATE" ]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8s-sidecar-injector
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get","watch","list"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8s-sidecar-injector
subjects:
  - kind: ServiceAccount
    name: k8s-sidecar-injector
    namespace: ${NAMESPACE}
roleRef:
  kind: ClusterRole
  name: k8s-sidecar-injector
  apiGroup: rbac.authorization.k8s.io


---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8s-sidecar-injector
  namespace: ${NAMESPACE}
  labels:
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: sidecar-config
  namespace: ${NAMESPACE}
  labels:
    app: k8s-sidecar-injector
    track: test
data:
  auditlog: |
    name: auditlog
    containers:
    - name: auditlog
      image: nginx:1.12.2
      command:
      - sh
      - -c
      - touch /var/log/tidb/tidb-audit.log; tail -n0 -F /var/log/tidb/tidb-audit.log;
      volumeMounts:
      - mountPath: /var/log/tidb
        name: slowlog

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: "k8s-sidecar-injector-prod"
  namespace: ${NAMESPACE}
  labels:
    k8s-app: "k8s-sidecar-injector"
    track: "prod"
spec:
  replicas: 1
  template:
    metadata:
      labels:
        k8s-app: "k8s-sidecar-injector"
        track: "prod"
    spec:
      serviceAccountName: k8s-sidecar-injector
      volumes:
        - name: secrets
          secret:
            secretName: sidecar-injector-webhook-certs
      containers:
        - name: "k8s-sidecar-injector"
          imagePullPolicy: Always
          image: tumblr/k8s-sidecar-injector:latest
          command: ["entrypoint.sh"]
          args: []
          ports:
            - name: https
              containerPort: 9443
            - name: http-metrics
              containerPort: 9000
          volumeMounts:
            - name: secrets
              mountPath: /var/lib/secrets
          livenessProbe:
            httpGet:
              scheme: HTTPS
              path: /health
              port: https
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 3
          resources:
            requests:
              cpu: "0.5"
              memory: 1Gi
            limits:
              cpu: "0.5"
              memory: 2Gi
          env:
            - name: "TLS_CERT_FILE"
              value: "/var/lib/secrets/cert.pem"
            - name: "TLS_KEY_FILE"
              value: "/var/lib/secrets/key.pem"
            - name: "LOG_LEVEL"
              value: "2"
            - name: "CONFIG_DIR"
              value: "conf/"
            - name: "CONFIGMAP_LABELS"
              value: "app=k8s-sidecar-injector"

---
apiVersion: v1
kind: Service
metadata:
  namespace: ${NAMESPACE}
  name: sidecar-injector-webhook-svc
  labels:
    k8s-app: k8s-sidecar-injector
    track: prod
spec:
  type: ClusterIP
  # NOTE(gabe): because of how MutatingWebhookConfigurations work, we MUST set this to have a clusterip
  # to avoid the thiccc chains of
  # W0802 14:53:36.704545       1 admission.go:253] Failed calling webhook, failing open injector.tumblr.com: failed calling admission webhook "injector.tumblr.com": Post https://k8s-sidecar-injector-prod.sre-sys.svc:443/mutate: cannot route to service with ClusterIP "None"
  # E0802 14:53:36.704610       1 admission.go:254] failed calling admission webhook "injector.tumblr.com": Post https://k8s-sidecar-injector-prod.sre-sys.svc:443/mutate: cannot route to service with ClusterIP "None"
  #clusterIP: None
  ports:
    - name: https
      port: 443
      targetPort: https
      protocol: TCP
    - name: http-metrics
      port: 80
      targetPort: http-metrics
      protocol: TCP
  selector:
    k8s-app: k8s-sidecar-injector
    track: prod