---
# Source: tunnel/templates/namespace.yaml
# tunnel — https://github.com/scaffoldly/tunnel
#
# The controller creates two classes at startup, one per tunnel provider:
#
#   tunnel.pizza            named hostnames under tunneled.pizza
#   api.trycloudflare.com   Cloudflare quick tunnels, no account, no us
#
# Opt a workload in with `ingressClassName` or `gatewayClassName: <one of the
# above>`. Neither is a default class, so nothing is claimed implicitly. The
# public hostname appears in the ADDRESS column of `kubectl get ingress`, or in
# `status.addresses` on a Gateway, and is not stable across controller restarts.
#
# A Gateway takes its backend from the HTTPRoutes that name it, so it has no
# address until one exists. Gateway API CRDs are installed if you have none.
apiVersion: v1
kind: Namespace
metadata:
  name: tunnel-system
  labels:
    app.kubernetes.io/name: tunnel
---
# Source: tunnel/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tunnel-controller
  namespace: tunnel-system
  labels:
    app.kubernetes.io/name: tunnel
---
# Source: tunnel/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tunnel-controller
  labels:
    app.kubernetes.io/name: tunnel
rules:
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch", "create", "update", "delete"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses/status"]
    verbs: ["update"]
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["services/status"]
    verbs: ["patch"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingressclasses"]
    verbs: ["get", "list", "watch", "create"]
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["gateways"]
    verbs: ["get", "list", "watch", "create", "update", "delete"]
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["gateways/status"]
    verbs: ["update"]
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["httproutes"]
    verbs: ["get", "list", "watch", "create", "update", "delete"]
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["gatewayclasses"]
    verbs: ["get", "list", "watch", "create"]
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["gatewayclasses/status"]
    verbs: ["update"]
  - apiGroups: ["events.k8s.io"]
    resources: ["events"]
    verbs: ["create", "patch"]
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "watch", "create", "update"]
---
# Source: tunnel/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tunnel-controller
  labels:
    app.kubernetes.io/name: tunnel
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tunnel-controller
subjects:
  - kind: ServiceAccount
    name: tunnel-controller
    namespace: tunnel-system
---
# Source: tunnel/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tunnel-controller
  namespace: tunnel-system
  labels:
    app.kubernetes.io/name: tunnel
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: tunnel
  template:
    metadata:
      labels:
        app.kubernetes.io/name: tunnel
    spec:
      serviceAccountName: tunnel-controller
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: controller
          image: "ghcr.io/scaffoldly/tunnel:0.1.0"
          ports:
            - name: metrics
              containerPort: 8080
            - name: health
              containerPort: 8081
          livenessProbe:
            httpGet:
              path: /healthz
              port: health
            initialDelaySeconds: 15
          readinessProbe:
            httpGet:
              path: /readyz
              port: health
            initialDelaySeconds: 5
          resources:
            requests:
              cpu: 10m
              memory: 64Mi
            limits:
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]