---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: resource-metrics
  name: leakedresources
rules:
  - apiGroups: [""]
    resources: ["pods","secrets", "namespaces"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["pingcap.com"]
    resources: ["tidbclusters"]
    verbs: ["*"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leakedresources
  namespace: resource-metrics
subjects:
  - kind: ServiceAccount
    name: leakedresources
    namespace: resource-metrics
roleRef:
  kind: Role
  name: leakedresources
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: leakedresources
  namespace: resource-metrics
rules:
  - apiGroups: [""]
    resources: ["pods","secrets", "namespaces"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["pingcap.com"]
    resources: ["tidbclusters"]
    verbs: ["*"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: leakedresources
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: leakedresources
    namespace: resource-metrics

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: leakedresources
  namespace: resource-metrics
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: leakedresources
  namespace: resource-metrics
  labels:
    app: leakedresources
spec:
  selector:
    matchLabels:
      app: leakedresources
  endpoints:
    - port: web
---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::385595570414:role/aws-resource-monitor
  name: leakedresources
  namespace: resource-metrics
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    prometheus.io/port: "8000"
    prometheus.io/scrape: "true"
  labels:
    app: leakedresources
  name: leakedresources
  namespace: resource-metrics
spec:
  ports:
    - name: web
      port: 8000
      protocol: TCP
  selector:
    app: leakedresources
  type: ClusterIP
---
kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    app: leakedresources
  name: leakedresources
  namespace: resource-metrics
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: leakedresources
  template:
    metadata:
      labels:
        app: leakedresources
    spec:
      containers:
        - name: metrics
          image: knightxun/leaked-resources:v0.0.1
          imagePullPolicy: Always
          args: [ '/usr/bin/python3', 'leaked.py' ]
          env:
            - name: passwd
              value: "sTLCdjxgGcPsW8u"
          ports:
            - containerPort: 8000
      serviceAccountName: leakedresources
      serviceAccount: leakedresources