# Copyright 2019 Copyright (c) 2019 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
landscape: (( &temporary ))
imports: (( &temporary ))
utilities: (( &temporary ))

plugins:
  - pinned:
    - helm:
      - kubeapiserver
      - template
    - kubectl: kubeapiserver

settings:
  apiserver_dns: (( "api." imports.ingress_controller.export.ingress_domain ))
  gardener_dns: (( "gardener." imports.ingress_controller.export.ingress_domain ))
  apiserver_url_internal: (( "https://" .kubeapiserver.serviceName "." .kubeapiserver.namespace ".svc:443" ))

spec:
  <<: (( &temporary ))

  KeyCert: (( |cert|->{$crt=cert.value.cert, $key=cert.value.key} ))

  new:
    service_account_key: (( &template(x509genkey()) ))
    basic_auth:          (( &template(exec( "bash", "-c", "cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1" )) ))

  server:
    commonName: "garden:server:kube-apiserver"
    validity: 87600
    usage:
      - ServerAuth
      - Signature
      - KeyEncipherment
    hosts:
      - "127.0.0.1"
      - "localhost"
      - "100.64.0.1"
      - <<: (( utilities.svcHosts("garden-kube-apiserver", landscape.namespace)  ))
      - <<: (( utilities.svcHosts("kubernetes", "default")  ))
      - (( .settings.apiserver_dns ))
      - (( .settings.gardener_dns ))

  client:
    common:
      validity: 87600
      usage:
        - Signature
        - ClientAuth
        - KeyEncipherment

    kube_controller_manager:
      <<: (( common ))
      commonName: "system:kube-controller-manager"

    admin:
      <<: (( common ))
      commonName: "garden:client:admin"
      organization: "system:masters"
  aggregator_client:
    <<: (( client.common ))
    commonName: "garden:aggregator-client:kube-aggregator"

state:
  <<: (( &state(merge none) ))
  kube_apiserver_ca:           (( utilities.certs.selfSignedCA("garden:ca:kube-apiserver", false) ))
  kube_apiserver_server:       (( utilities.certs.keyCertForCA(spec.server, kube_apiserver_ca, false) ))
  kube_apiserver_client_kube_controller_manager: (( utilities.certs.keyCertForCA(spec.client.kube_controller_manager, kube_apiserver_ca, false) ))
  kube_apiserver_client_admin: (( utilities.certs.keyCertForCA(spec.client.admin, kube_apiserver_ca, false) ))

  kube_aggregator_ca:          (( utilities.certs.selfSignedCA("garden:ca:kube-aggregator", false) ))
  kube_aggregator_client:      (( utilities.certs.keyCertForCA(spec.aggregator_client, kube_aggregator_ca, false) ))
  service_account_key:         (( utilities.state.valuedata(~,spec.new.service_account_key, false) ))
  basic_auth:                  (( utilities.state.valuedata(~,spec.new.basic_auth, false) ))


kubeapiserver:
  kubeconfig: (( landscape.clusters.[0].kubeconfig ))
  files:
    - "kubeapiserver/rendered_charts.yaml"
  source: chart
  name: "garden-kube-apiserver"
  namespace: (( .landscape.namespace ))
  serviceName: (( name ))
  values:
    images:
      hyperkube: (( .landscape.versions.kube-apiserver.image_repo ":" .landscape.versions.kube-apiserver.image_tag ))
    resources:
      <<: (( .landscape.versions.kube-apiserver.resources || ~ ))
    apiServer:
      hostname: (( .settings.apiserver_dns ))
      serviceName: (( name ))
    tls:
      kubeAPIServer:
        ca: (( spec.KeyCert(.state.kube_apiserver_ca) ))
        server: (( spec.KeyCert(.state.kube_apiserver_server) ))
        basicAuthPassword: (( .state.basic_auth.value ))
      kubeAggregator:
        ca: (( spec.KeyCert(.state.kube_aggregator_ca) ))
        client: (( spec.KeyCert(.state.kube_aggregator_client) ))
      admin: (( spec.KeyCert(.state.kube_apiserver_client_admin) ))
      kubeControllerManager: (( spec.KeyCert(.state.kube_apiserver_client_kube_controller_manager) ))
      serviceAccountKey: (( .state.service_account_key.value ))
      identity:
        ca: (( .imports.cert-controller.export.ca.crt || ~~ ))
    etcd:
      main:
        endpoints: (( join(",",.imports.etcd.exports.endpoints.main) ))
      events:
        endpoints: (( join(",",.imports.etcd.exports.endpoints.events) ))
      secretNames:
        ca: garden-etcd-main-ca
        client: garden-etcd-main-client
    networkPolicies: (( .landscape.gardener.network-policies.active || false ))