00-etcdproxy-controller.yaml

---
# The Namespace where controller and controller resources are deployed.
apiVersion: v1
kind: Namespace
metadata:
  name: kube-apiserver-storage
spec:
---
# The ServiceAccount used by EtcdProxyController.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: etcdproxy-controller-sa
  namespace: kube-apiserver-storage
---
# The ServiceAccount used by EtcdProxy pods.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: etcdproxy-sa
  namespace: kube-apiserver-storage
---
# ClusterRole for etcdproxy-controller-sa to get EtcdStorages and update status.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: etcdproxy-crd-clusterrole
rules:
- apiGroups: ["etcd.xmudrii.com"]
  resources: ["etcdstorages"]
  verbs: ["get", "watch", "list"]
- apiGroups: ["etcd.xmudrii.com"]
  resources: ["etcdstorages/status"]
  verbs: ["update", "patch"]
---
# Role for etcdproxy-controller-sa to manage Deployments, Services, ConfigMap and Secrets.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: etcdproxy-controller-role
  namespace: kube-apiserver-storage
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["secrets", "configmaps"]
  verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
---
# ClusterRoleBinding to bind ClusterRole for managing EtcdStorage objects to etcdproxy-controller-sa.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: etcdproxy-crd-clusterrolebinding
subjects:
- kind: ServiceAccount
  name: etcdproxy-controller-sa
  namespace: kube-apiserver-storage
roleRef:
  kind: ClusterRole
  name: etcdproxy-crd-clusterrole
  apiGroup: rbac.authorization.k8s.io
---
# RoleBinding to bind Role for managing resources in controller namespace to etcdproxy-controller-sa.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: etcdproxy-controller-rolebinding
  namespace: kube-apiserver-storage
subjects:
- kind: ServiceAccount
  name: etcdproxy-controller-sa
  namespace: kube-apiserver-storage
roleRef:
  kind: Role
  name: etcdproxy-controller-role
  apiGroup: rbac.authorization.k8s.io
---
# EtcdStorage CRD.
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: etcdstorages.etcd.xmudrii.com
spec:
  group: etcd.xmudrii.com
  version: v1alpha1
  names:
    kind: EtcdStorage
    plural: etcdstorages
  scope: Cluster
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        metadata:
          properties:
            name:
              type: string
              maxLength: 59 # because of service name, explained above.
        spec:
          required: ["signingCertificateValidity", "servingCertificateValidity", "clientCertificateValidity"]
          properties:
            caCertConfigMap:
              type: array
              items:
                type: object
                required: ["name", "namespace"]
                properties:
                  name:
                    type: string
                    pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$'
                  namespace:
                    type: string
                    pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
            clientCertSecret:
              type: array
              items:
                type: object
                required: ["name", "namespace"]
                properties:
                  name:
                    type: string
                    pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$'
                  namespace:
                    type: string
                    pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
            signingCertificateValidity:
              type: string
              pattern: '^[0-9]*[.]?[0-9]*(ns|us|ms|m|s|h)'
            servingCertificateValidity:
              type: string
              pattern: '^[0-9]*[.]?[0-9]*(ns|us|ms|m|s|h)'
            clientCertificateValidity:
              type: string
              pattern: '^[0-9]*[.]?[0-9]*(ns|us|ms|m|s|h)'
---
# Controller deployment.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: etcdproxy-controller-deployment
  namespace: kube-apiserver-storage
  labels:
    controller: etcdproxy
spec:
  replicas: 1
  selector:
    matchLabels:
      controller: etcdproxy
  template:
    metadata:
      labels:
        controller: etcdproxy
    spec:
      serviceAccountName: etcdproxy-controller-sa
      containers:
      - name: etcdproxy-controller
        image: xmudrii/etcdproxy-controller:latest
        command:
          - /etcdproxy-controller
          - "--etcd-core-url=https://etcd-svc-1.etcd.svc:2379"
        imagePullPolicy: IfNotPresent