apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-config
data:
  config: |-
    [default]
    region = us-west-2
    role_arn = arn:aws:iam::385595570414:role/eksprovider-dev-seed-us-west-2-eks-infra-provider
    web_identity_token_file = /var/run/secrets/eks.amazonaws.com/serviceaccount/token

    [profile tenant]
    region = us-west-2
    role_arn = arn:aws:iam::510387698298:role/assume-role-10y6nmsv
    external_id = 123456
    source_profile = default
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: kube-script
data:
  kuber.sh: |
    #!/usr/bin/env bash
    region=us-west-2
    kubeconfig=/kubeconfig
    clusters=$(kubectl get clusters.eks.aws.crossplane.io -oname | awk -F'/' '{print $2}')
    for cluster in $clusters; do
        endpoint=$(kubectl get cluster.eks.aws.crossplane.io "${cluster}" -ojsonpath='{.metadata.annotations.infra\.pingcap\.com/eks-endpoint}')
        if AWS_PROFILE=tenant aws eks --region ${region} update-kubeconfig --name "${cluster}" --kubeconfig ${kubeconfig} ; then
          ctx=$(kubectl config --kubeconfig ${kubeconfig} current-context)
          kubectl config --kubeconfig ${kubeconfig} set-cluster "${ctx}" --server="${endpoint}" --insecure-skip-tls-verify
        fi
    done
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: debug
  labels:
    app: debug
spec:
  replicas: 1
  selector:
    matchLabels:
      app: debug
  template:
    metadata:
      labels:
        app: debug
    spec:
      serviceAccountName: eks-infra-provider
      containers:
      - name: debug
        image: gcr.io/pingcap-public/cockpit:latest
        command: ["tail", "-f", "/dev/null"]
        env:
        - name: KUBECONFIG
          value: /.kube/config
        - name: AWS_CONFIG_FILE
          value: /.aws/config
        volumeMounts:
        - name: kubeconfig
          mountPath: /.kube
        - name: awsconfig
          mountPath: /.aws
        - name: kubescript
          mountPath: /hack
      volumes:
      - name: kubeconfig
        secret:
          secretName: api-server-kubeconfig
      - name: awsconfig
        configMap:
          name: aws-config
      - name: kubescript
        configMap:
          name: kube-script
          defaultMode: 493