---
# Source: cloudbees-sidecar-injector/templates/poddisruptionbudget.yaml
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: cloudbees-sidecar-injector
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: "cloudbees-sidecar-injector"
      app.kubernetes.io/instance: "cloudbees-sidecar-injector"
---
# Source: cloudbees-sidecar-injector/templates/init-serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cloudbees-sidecar-injector-init
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector-init
---
# Source: cloudbees-sidecar-injector/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cloudbees-sidecar-injector
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector
    cloudbees: sidecar-injector
---
# Source: cloudbees-sidecar-injector/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: cloudbees-sidecar-injector
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector
data:
  sidecarconfig.yaml: |-
    annotationPrefix: com.cloudbees.sidecar-injector
    requiresExplicitInjection: false
    container:
      volumeMounts:
        - name: bundles
          mountPath: /etc/ssl/certs/ca-certificates.crt
          subPath: ca-certificates.crt
        - name: bundles
          mountPath: /etc/pki/tls/certs/ca-bundle.crt
          subPath: ca-certificates.crt
        - name: bundles
          mountPath: /etc/ssl/ca-bundle.pem
          subPath: ca-certificates.crt
        - name: bundles
          mountPath: /etc/pki/tls/cacert.pem
          subPath: ca-certificates.crt
        - name: bundles
          mountPath: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
          subPath: ca-certificates.crt
        - name: bundles
          mountPath: /etc/ssl/certs/java/cacerts
          subPath: cacerts
        - name: bundles
          mountPath: /var/lib/ca-certificates/java-cacerts
          subPath: cacerts
        - name: bundles
          mountPath: /etc/pki/java/cacerts
          subPath: cacerts
    volumes:
      - name: bundles
        configMap:
          name: ca-bundles
---
# Source: cloudbees-sidecar-injector/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cloudbees-sidecar-injector-cloudbees-sidecar-injector
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector
rules:
# Needed to update webhook configuration with TLS cert
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  verbs:
  - get
  - list
  - watch
  - patch
---
# Source: cloudbees-sidecar-injector/templates/init-clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cloudbees-sidecar-injector-cloudbees-sidecar-injector-init
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector-init
rules:
- apiGroups: ["certificates.k8s.io"]
  resources: ["certificatesigningrequests"]
  verbs: ["create", "get", "watch", "delete"]
- apiGroups: ["certificates.k8s.io"]
  resources: ["certificatesigningrequests/approval"]
  verbs: ["update"]
---
# Source: cloudbees-sidecar-injector/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cloudbees-sidecar-injector-cloudbees-sidecar-injector
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cloudbees-sidecar-injector-cloudbees-sidecar-injector
subjects:
  - kind: ServiceAccount
    name: cloudbees-sidecar-injector
    namespace: cloudbees-sidecar-injector
---
# Source: cloudbees-sidecar-injector/templates/init-clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cloudbees-sidecar-injector-cloudbees-sidecar-injector-init
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector-init
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cloudbees-sidecar-injector-cloudbees-sidecar-injector-init
subjects:
  - kind: ServiceAccount
    name: cloudbees-sidecar-injector-init
    namespace: cloudbees-sidecar-injector
---
# Source: cloudbees-sidecar-injector/templates/init-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cloudbees-sidecar-injector-init
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector-init
rules:
- apiGroups:
  - ''
  resources:
  - secrets
  verbs:
  - create
  - update
  - get
---
# Source: cloudbees-sidecar-injector/templates/init-rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cloudbees-sidecar-injector-init
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector-init
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cloudbees-sidecar-injector-init
subjects:
  - kind: ServiceAccount
    name: cloudbees-sidecar-injector-init
---
# Source: cloudbees-sidecar-injector/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: cloudbees-sidecar-injector
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector
    cloudbees: sidecar-injector
spec:
  ports:
  - port: 443
    targetPort: 8443
  selector:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector
---
# Source: cloudbees-sidecar-injector/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cloudbees-sidecar-injector
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: "cloudbees-sidecar-injector"
      app.kubernetes.io/name: "cloudbees-sidecar-injector"
      app.kubernetes.io/managed-by: "Helm"
      helm.sh/chart: "cloudbees-sidecar-injector"
      app.kubernetes.io/component: cloudbees-sidecar-injector
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: "cloudbees-sidecar-injector"
        app.kubernetes.io/name: "cloudbees-sidecar-injector"
        app.kubernetes.io/managed-by: "Helm"
        helm.sh/chart: "cloudbees-sidecar-injector"
        app.kubernetes.io/component: cloudbees-sidecar-injector
      annotations:
        com.cloudbees.sidecar-injector/inject: "false"
    spec:
      serviceAccountName: cloudbees-sidecar-injector
      containers:
        - name: sidecar-injector-webhook
          image: "cloudbees/sidecar-injector:2.0.5"
          imagePullPolicy: IfNotPresent
          args:
            - --webhookConfigName=cloudbees-sidecar-injector
            - --configFile=/etc/cloudbees/config/sidecarconfig.yaml
            - --tlsCertFile=/etc/cloudbees/certs/tls.crt
            - --tlsKeyFile=/etc/cloudbees/certs/tls.key
            - --port=8443
          volumeMounts:
          - name: certs
            mountPath: /etc/cloudbees/certs
            readOnly: true
          - name: config
            mountPath: /etc/cloudbees/config
            readOnly: true
          resources:
      volumes:
      - name: certs
        secret:
          secretName: cloudbees-sidecar-injector
      - name: config
        configMap:
          name: cloudbees-sidecar-injector
      affinity:      
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/os
                operator: In
                values:
                - linux
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - "amd64"
                - "ppc64le"
                - "s390x"
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 2
            preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - "amd64"
          - weight: 2
            preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - "ppc64le"
          - weight: 2
            preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - "s390x"
---
# Source: cloudbees-sidecar-injector/templates/init-cronjob.yaml
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: "cloudbees-sidecar-injector"
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector-init
spec:
  schedule: "0 0 */1 * *" # Once a day
  jobTemplate:
    spec:
      template:
        spec:
          nodeSelector:
            # Schedule on linux nodes only.
            kubernetes.io/os: linux
          serviceAccountName: cloudbees-sidecar-injector-init
          restartPolicy: OnFailure
          containers:
          # The init-certs container sends a certificate signing request to the
          # kubernetes cluster.
          # You can see pending requests using: kubectl get csr
          # CSRs can be approved using:         kubectl certificate approve <csr name>
          - name: init-certs
            image: "cloudbees/cert-requester:2.0.5"
            imagePullPolicy: ""
            args:
            - "--serviceName=cloudbees-sidecar-injector"
            - "--autoApproveCSR=true"
---
# Source: cloudbees-sidecar-injector/templates/mutatingwebhook.yaml
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: cloudbees-sidecar-injector
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector
webhooks:
  - name: com.cloudbees.sidecar-injector
    clientConfig:
      service:
        name: cloudbees-sidecar-injector
        namespace: cloudbees-sidecar-injector
        path: "/mutate"
      caBundle: ""
    rules:
      - operations: [ "CREATE" ]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
    failurePolicy: Fail
    namespaceSelector:
      matchLabels:
        sidecar-injector: enabled
---
# Source: cloudbees-sidecar-injector/templates/init-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: "cloudbees-sidecar-injector-init"
  labels:
    app.kubernetes.io/instance: "cloudbees-sidecar-injector"
    app.kubernetes.io/name: "cloudbees-sidecar-injector"
    app.kubernetes.io/managed-by: "Helm"
    helm.sh/chart: "cloudbees-sidecar-injector"
    app.kubernetes.io/component: cloudbees-sidecar-injector-init # Otherwise we'll wait for CSR forever
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  template:
    spec:
      nodeSelector:
        # Schedule on linux nodes only.
        kubernetes.io/os: linux
      serviceAccountName: cloudbees-sidecar-injector-init
      restartPolicy: OnFailure
      containers:
      # The init-certs container sends a certificate signing request to the
      # kubernetes cluster.
      # You can see pending requests using: kubectl get csr
      # CSRs can be approved using:         kubectl certificate approve <csr name>
      - name: init-certs
        image: "cloudbees/cert-requester:2.0.5"
        imagePullPolicy: ""
        args:
        - "--serviceName=cloudbees-sidecar-injector"
        - "--autoApproveCSR=true"
