kind: ServiceAccount
apiVersion: v1
metadata:
  name: cdi-sa
  namespace: kube-system
  labels:
    cdi.kubevirt.io: ""
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cdi
  labels:
    cdi.kubevirt.io: ""
rules:
- apiGroups: [""]
  resources: ["events"]
  verbs: ["create", "update", "patch"]
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "list", "watch", "create", "update", "patch"]
- apiGroups: [""]
  resources: ["persistentvolumeclaims/finalizers"]
  verbs: ["update"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch", "create", "delete"]
- apiGroups: [""]
  resources: ["pods/finalizers"]
  verbs: ["update"]
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "list", "watch", "create", "delete"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch", "create"]
- apiGroups: ["storage.k8s.io"]
  resources: ["storageclasses"]
  verbs: ["get"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "watch", "create"]
- apiGroups: ["cdi.kubevirt.io"]
  resources:
   - '*'
  verbs:
   - '*'
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: cdi-sa
  labels:
    cdi.kubevirt.io: ""
roleRef:
  kind: ClusterRole
  name: cdi
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: cdi-sa
    namespace: kube-system
---
apiVersion: apps/v1beta2
kind: Deployment
metadata:
  name: cdi-deployment
  namespace: kube-system
  labels:
    cdi.kubevirt.io: ""
    app: containerized-data-importer
spec:
  selector:
    matchLabels:
      app: containerized-data-importer
  replicas: 1
  template:
    metadata:
      labels:
        app: containerized-data-importer
        cdi.kubevirt.io: ""
    spec:
      serviceAccountName: cdi-sa
      containers:
      - name: cdi-controller
        image: kubevirt/cdi-controller:v1.4.0
        imagePullPolicy: IfNotPresent
        args: ["-v=1"] # default verbosity; change to 2 or 3 for more detailed logging
        env:
        - name: IMPORTER_IMAGE
          value: kubevirt/cdi-importer:v1.4.0
        - name: CLONER_IMAGE
          value: kubevirt/cdi-cloner:v1.4.0
        - name: UPLOADSERVER_IMAGE
          value: kubevirt/cdi-uploadserver:v1.4.0  
        - name: PULL_POLICY
          value: IfNotPresent
        - name: UPLOADPROXY_SERVICE
          value: cdi-uploadproxy
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  labels:
    cdi.kubevirt.io: ""
  name: datavolumes.cdi.kubevirt.io
spec:
  group: cdi.kubevirt.io
  names:
    kind: DataVolume
    plural: datavolumes
    shortNames:
    - dv
    - dvs
    singular: datavolume
  scope: Namespaced
  validation:
    openAPIV3Schema:	
      properties:	
        apiVersion:	
          type: string	
        kind:	
          type: string
        metadata: {}	
        spec:	
          properties:
            source:
              properties:
                http:
                  properties:
                    url:
                      type: string
                    secretRef:
                      type: string
                  required:
                  - url
                s3:
                  properties:
                    url:
                      type: string
                    secretRef:
                      type: string
                  required:
                  - url
                pvc:
                  properties:
                    namespace:
                      type: string
                    name:
                      type: string
                  required:
                  - namespace
                  - name
                upload:
                blank:
            pvc:
              properties:
                resources:
                  properties:
                    requests:
                      properties:
                        storage:
                          type: string
                      required:
                      - storage
                  required:
                  - requests
                storageClassName:
                  type: string
                accessModes:
                  type: array
              required:
              - resources
    
  version: v1alpha1
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: cdi-apiserver
  namespace: kube-system
  labels:
    cdi.kubevirt.io: ""
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: cdi-apiserver
  namespace: kube-system
  labels:
    cdi.kubevirt.io: ""
roleRef:
  kind: Role
  name: cdi-apiserver
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: cdi-apiserver
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name: cdi-apiserver
  namespace: kube-system
  labels:
    cdi.kubevirt.io: ""
rules:
  - apiGroups:
      - ''
    resources:
      - secrets
    verbs:
      - get
      - create
  - apiGroups:
      - ''
    resources:
      - configmaps
    verbs:
      - get
      - create
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: cdi-extension-apiserver-authentication
  namespace: kube-system
  labels:
    cdi.kubevirt.io: ""
roleRef:
  kind: Role
  name: cdi-extension-apiserver-authentication
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: cdi-apiserver
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name: cdi-extension-apiserver-authentication
  namespace: kube-system
  labels:
    cdi.kubevirt.io: ""
rules:
  - apiGroups:
      - ''
    resources:
      - configmaps
    resourceNames:
      - extension-apiserver-authentication
    verbs:
      - get
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: cdi-apiserver
  labels:
    cdi.kubevirt.io: ""
roleRef:
  kind: ClusterRole
  name: cdi-apiserver
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: cdi-apiserver
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: cdi-apiserver
  labels:
    cdi.kubevirt.io: ""
rules:
  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - validatingwebhookconfigurations
    verbs:
      - get
      - create
      - update
  - apiGroups:
      - apiregistration.k8s.io
    resources:
      - apiservices
    verbs:
      - get
      - create
      - update
  - apiGroups:
      - ''
    resources:
      - pods
      - persistentvolumeclaims
    verbs:
      - get
      - list
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: cdi-apiserver-auth-delegator
  labels:
    cdi.kubevirt.io: ""
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: cdi-apiserver
  namespace: kube-system
---
apiVersion: v1
kind: Service
metadata:
  name: cdi-api
  namespace: kube-system
  labels:
    cdi.kubevirt.io: "cdi-api"
spec:
  ports:
    - port: 443
      targetPort: 8443
      protocol: TCP
  selector:
    cdi.kubevirt.io: cdi-api
---
apiVersion: apps/v1beta2
kind: Deployment
metadata:
  name: cdi-api
  namespace: kube-system
  labels:
    cdi.kubevirt.io: "cdi-api"
spec:
  selector:
    matchLabels:
      cdi.kubevirt.io: "cdi-api"
  replicas: 1
  template:
    metadata:
      labels:
        cdi.kubevirt.io: "cdi-api"
    spec:
      serviceAccountName: cdi-apiserver
      containers:
      - name: cdi-apiserver-api
        image: kubevirt/cdi-apiserver:v1.4.0
        imagePullPolicy: IfNotPresent
        args: ["-v=1"] # default verbosity; change to 2 or 3 for more detailed logging
---
apiVersion: v1
kind: Service
metadata:
  name: cdi-uploadproxy
  namespace: kube-system
  labels:
    cdi.kubevirt.io: "cdi-uploadproxy"
spec:
  ports:
    - port: 443
      targetPort: 8443
      protocol: TCP
  selector:
    cdi.kubevirt.io: cdi-uploadproxy
---
apiVersion: apps/v1beta2
kind: Deployment
metadata:
  name: cdi-uploadproxy
  namespace: kube-system
  labels:
    cdi.kubevirt.io: "cdi-uploadproxy"
spec:
  selector:
    matchLabels:
      cdi.kubevirt.io: "cdi-uploadproxy"
  replicas: 1
  template:
    metadata:
      labels:
        cdi.kubevirt.io: "cdi-uploadproxy"
    spec:
      containers:
      - name: cdi-uploadproxy
        image: kubevirt/cdi-uploadproxy:v1.4.0
        imagePullPolicy: IfNotPresent
        args: ["-v=1"] # default verbosity; change to 2 or 3 for more detailed logging
        env:
        - name: APISERVER_PUBLIC_KEY
          valueFrom:
            secretKeyRef:
              name: cdi-api-signing-key
              key: id_rsa.pub
        - name: UPLOAD_SERVER_CLIENT_KEY
          valueFrom:
            secretKeyRef:
              name: cdi-upload-server-client-key
              key: tls.key
        - name: UPLOAD_SERVER_CLIENT_CERT
          valueFrom:
            secretKeyRef:
              name: cdi-upload-server-client-key
              key: tls.crt
        - name: UPLOAD_SERVER_CA_CERT
          valueFrom:
            secretKeyRef:
              name: cdi-upload-server-client-key
              key: ca.crt
        - name: SERVICE_TLS_KEY
          valueFrom:
            secretKeyRef:
              name: cdi-upload-proxy-server-key
              key: tls.key
        - name: SERVICE_TLS_CERT
          valueFrom:
            secretKeyRef:
              name: cdi-upload-proxy-server-key
              key: tls.crt
---
apiVersion: v1
kind: Service
metadata:
  name: kubevirt-prometheus-metrics
  namespace: kube-system
  labels:
    prometheus.kubevirt.io: ""
    kubevirt.io: ""
spec:
  ports:
    - name: metrics
      port: 443
      targetPort: metrics
      protocol: TCP
  selector:
    prometheus.kubevirt.io: ""
