---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-operators-proxy-webhook
  namespace: tekton-pipelines

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tekton-operators-proxy-admin
rules:
  - apiGroups: [""]
    resources: ["pods", "configmaps", "services", "events"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments", "deployments/finalizers"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  # We uses leases for leaderelection
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]

---

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tekton-operators-proxy-admin
  namespace: tekton-pipelines
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tekton-operators-proxy-webhook-admin
subjects:
  - kind: ServiceAccount
    name: tekton-operators-proxy-webhook
    namespace: tekton-pipelines
roleRef:
  kind: ClusterRole
  name: tekton-operators-proxy-admin
  apiGroup: rbac.authorization.k8s.io

---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tekton-operators-proxy-webhook-admin
  namespace: tekton-pipelines
subjects:
  - kind: ServiceAccount
    name: tekton-operators-proxy-webhook
    namespace: tekton-pipelines
roleRef:
  kind: Role
  name: tekton-operators-proxy-admin
  apiGroup: rbac.authorization.k8s.io

---

apiVersion: v1
kind: Secret
metadata:
  name: proxy-webhook-certs
  namespace: tekton-pipelines

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: tekton-operator-proxy-webhook
  namespace: tekton-pipelines
  labels:
    version: "devel"
    operator.tekton.dev/release: "devel"
spec:
  replicas: 1
  selector:
    matchLabels:
      name: tekton-operator
  template:
    metadata:
      labels:
        name: tekton-operator
        app: tekton-operator
    spec:
      serviceAccountName: tekton-operators-proxy-webhook
      containers:
        - name: proxy
          image: "ko://github.com/tektoncd/operator/cmd/openshift/proxy-webhook"
          env:
            - name: SYSTEM_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: WEBHOOK_SERVICE_NAME
              value: tekton-operator-proxy-webhook
            - name: WEBHOOK_SECRET_NAME
              value: proxy-webhook-certs
            - name: METRICS_DOMAIN
              value: tekton.dev/operator
          ports:
            - name: https-webhook
              containerPort: 8443
          securityContext:
            allowPrivilegeEscalation: false

---

apiVersion: v1
kind: Service
metadata:
  name: tekton-operator-proxy-webhook
  namespace: tekton-pipelines
  labels:
    version: "devel"
    operator.tekton.dev/release: "devel"
spec:
  ports:
    - name: https-webhook
      port: 443
      targetPort: 8443
  selector:
    name: tekton-operator

---

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: proxy.operator.tekton.dev
webhooks:
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: tekton-operator-proxy-webhook
        namespace: tekton-pipelines
    failurePolicy: Fail
    sideEffects: None
    name: proxy.operator.tekton.dev

---

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: annotation.operator.tekton.dev
webhooks:
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: tekton-operator-proxy-webhook
        namespace: tekton-pipelines
    failurePolicy: Fail
    sideEffects: None
    name: annotation.operator.tekton.dev
