apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
# The namespace of the resources
namespace: regional-server-system
configMapGenerator:
- files:
  - config/admin-node-role-policy-template.json
  name: admin-node-role-policy-template
- files:
  - config/admin-node-role-trust-policy.json
  name: admin-node-role-trust-policy
- files:
  - config/aws-lb-controller-policy.json
  name: aws-lb-controller-policy

labels:
- includeTemplates: true
  pairs:
    tags.tidbcloud.com/environment: dev
    tags.tidbcloud.com/servicetype: dedicated
    tags.tidbcloud.com/usedby: dbaas-control-plane-seed

resources:
- namespace.yaml
# - meta-namespace.yaml
- ../../base

patches:
- path: deployment.yaml
- path: service_account.yaml
- path: args-patch.yaml
- path: ports-patch.yaml
- path: service-patch.yaml
- target:
    group: rbac.authorization.k8s.io
    version: v1
    kind: ClusterRole
    name: dedicated-regional-server-manager-role
  patch: |-
    - op: add
      path: /rules/-
      value:
        apiGroups: [s3.aws.crossplane.io]
        resources: [buckets]
        verbs: ['*']
    - op: add
      path: /rules/-
      value:
        apiGroups: [s3.aws.upbound.io]
        resources: ['*']
        verbs: ['*']
    - op: add
      path: /rules/-
      value:
        apiGroups: [eks.aws.upbound.io]
        resources: ['*']
        verbs: ['*']
    - op: add
      path: /rules/-
      value:
        apiGroups: [ec2.aws.upbound.io]
        resources: ['*']
        verbs: ['*']
    - op: add
      path: /rules/-
      value:
        apiGroups: [agent.observability.pingcap.com]
        resources: ['*']
        verbs: ['*']