apiVersion: v1
kind: Namespace
metadata:
  name: pingcap
---
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: pingcap
  name: tidb-cloud-manager
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: pingcap:tidb-cloud-manager
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["configmaps", "services", "pods", "serviceaccounts", "persistentvolumes"]
  verbs: ["*"]
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["create", "delete"]
- apiGroups: ["apps", "extensions"]
  resources: ["deployments"]
  verbs: ["*"]
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "create", "update"]
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["get", "list", "create", "delete"]
- apiGroups: ["pingcap.com"]
  resources: ["tidbclusters", "tidbsets", "tidbinstances"]
  verbs: ["*"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["create", "get", "delete"]
- apiGroups: [""]
  resources: ["endpoints"]
  verbs: ["create", "get", "update"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles", "rolebindings"]
  verbs: ["get", "create", "list", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: pingcap:tidb-cloud-manager
subjects:
- kind: ServiceAccount
  name: tidb-cloud-manager
  namespace: pingcap
roleRef:
  kind: ClusterRole
  name: pingcap:tidb-cloud-manager
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Service
metadata:
  namespace: pingcap
  name: tidb-cloud-manager
spec:
  type: NodePort
  ports:
  - name: tidb-cloud-manager
    port: 2333
    targetPort: 2333
    nodePort: 32333
  selector:
    app: tidb-cloud-manager
---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  namespace: pingcap
  name: tidb-cloud-manager
spec:
  replicas: 1
  template:
    metadata:
      labels:
        name: tidb-cloud-manager
        app: tidb-cloud-manager
    spec:
      serviceAccount: tidb-cloud-manager
      containers:
      - name: tidb-cloud-manager
        image: pingcap/tidb-cloud-manager:latest
        command: ["/usr/local/bin/tidb-cloud-manager"]
        args:
          - -L=debug
          - -repo-prefix=uhub.ucloud.cn/pingcap
          # - -backup-dir=/data
          - -expose-privileged-tidb-svc=true
          - -rbac-enabled=true
          # - -alertmanagerURL=http://alertmanager.kube-system:9093
        env:
          - name: MY_POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace