# run as job
# apiVersion: batch/v1
# kind: Job

# run as Deployment
apiVersion: apps/v1
kind: Deployment

metadata:
  name: prerelease-cluster-controller-job
spec:
  replicas: 0
  template:
    spec:
      containers:
      - name: controller
        image: gcr.io/dbaas-prod/tidbcloud/gke-provider:v0.151.1
        volumeMounts:
          - name: storageclass-config
            mountPath: /etc/cluster-controller/storageclass
          - name: instancetype-config
            mountPath: /etc/cluster-controller/instancetype
      volumes:
        - name: storageclass-config
          configMap:
            name: extra-storageclass
        - name: instancetype-config
          configMap:
            name: instancetype
---
$patch: delete
apiVersion: batch/v1
kind: Job
metadata:
  name: prerelease-cluster-controller-job

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: readonly-cluster-controller
  annotations:
    iam.gke.io/gcp-service-account: prod-readonly-cc@dbaas-prod.iam.gserviceaccount.com

---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: readonly-infra-kubeconfig
  labels:
    app: gke-provider
spec:
  refreshInterval: 1h           # rate SecretManager pulls GCPSM
  secretStoreRef:
    kind: ClusterSecretStore
    name: default               # name of the SecretStore (or kind specified)
  target:
    name: readonly-infra-kubeconfig  # name of the k8s Secret to be created
    creationPolicy: Owner
  data:
    - secretKey: config
      remoteRef:
        key: prod-readonly-infra-kubeconfig   # name of the GCPSM secret key