---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: cost-optimization
  name: cleanups
rules:
  - apiGroups: [""]
    resources: ["pods","secrets", "namespaces"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["pingcap.com"]
    resources: ["tidbclusters"]
    verbs: ["*"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cleanups
  namespace: cost-optimization
subjects:
  - kind: ServiceAccount
    name: cleanups
    namespace: cost-optimization
roleRef:
  kind: Role
  name: cleanups
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cleanups
  namespace: cost-optimization
rules:
  - apiGroups: [""]
    resources: ["pods","secrets", "namespaces"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["pingcap.com"]
    resources: ["tidbclusters"]
    verbs: ["*"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cleanups
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: cleanups
    namespace: cost-optimization

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cleanups
  namespace: cost-optimization
---
apiVersion: batch/v1
kind: Job
metadata:
  name: chenfei-auto-cleanup-job
  namespace: cost-optimization
spec:
  template:
    spec:
      serviceAccountName: cleanups
      containers:
        - name: cleanups
          image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/cost-optimization:latest
          imagePullPolicy: Always
          args: ['python3', 'auto_cleanup.py']
          env:
            - name: environment
              value: "nightly"
      restartPolicy: OnFailure