apiVersion: v1
kind: Namespace
metadata:
  labels:
    control-plane: mac-controller-manager
    # in case mutatepods is set to opt-out mode,
    # make sure that KubeMacPool pods are also opted-out
    # to prevent dead-lock.
  name: system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: mac-range-config
  namespace: system
  labels:
    control-plane: mac-controller-manager
    controller-tools.k8s.io: "1.0"
data:
  RANGE_START: 02:00:00:00:00:00
  RANGE_END: 02:FF:FF:FF:FF:FF
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mac-controller-manager
  namespace: system
  labels:
    control-plane: mac-controller-manager
    controller-tools.k8s.io: "1.0"
spec:
  strategy:
    type: Recreate
  replicas: 1
  selector:
    matchLabels:
      control-plane: mac-controller-manager
      controller-tools.k8s.io: "1.0"
  template:
    metadata:
      labels:
        app: kubemacpool
        control-plane: mac-controller-manager
        controller-tools.k8s.io: "1.0"
      annotations:
        description: KubeMacPool manages MAC allocation to Pods and VMs
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: control-plane
                  operator: In
                  values:
                  - mac-controller-manager
              topologyKey: kubernetes.io/hostname
            weight: 1
      restartPolicy: Always
      containers:
      - command:
        - /manager
        args:
          - "--v=production"
          - "--wait-time=600"
        image: quay.io/kubevirt/kubemacpool:latest
        imagePullPolicy: Always
        name: manager
        env:
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: RANGE_START
            valueFrom:
              configMapKeyRef:
                name: mac-range-config
                key: RANGE_START
          - name: RANGE_END
            valueFrom:
              configMapKeyRef:
                name: mac-range-config
                key: RANGE_END
          - name: CA_ROTATE_INTERVAL
            value: "8760h0m0s" # One Year
          - name: CA_OVERLAP_INTERVAL
            value: "8760h0m0s" # One Year
          - name: CERT_ROTATE_INTERVAL
            value: "4380h0m0s" # Half Year
        resources:
          requests:
            cpu: 100m
            memory: 300Mi
        ports:
        - containerPort: 8000
          name: webhook-server
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /readyz
            port: webhook-server
            scheme: HTTPS
            httpHeaders:
            - name: Content-Type
              value: application/json
          initialDelaySeconds: 10
          periodSeconds: 10
        volumeMounts:
          - name: tls-key-pair
            readOnly: true
            mountPath: /etc/webhook/certs
      terminationGracePeriodSeconds: 5
      volumes:
        - name: tls-key-pair
          secret:
            secretName: service

---
apiVersion: v1
kind: Service
metadata:
  name: service
  namespace: kubemacpool-system
spec:
  publishNotReadyAddresses: true
  ports:
    - port: 443
      targetPort: 8000
  selector:
    app: kubemacpool
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  # metadata.name will be kubemacpool-mutator (prefix added by kustomize)
  name: mutator
  labels:
webhooks:
  - name: mutatepods.kubemacpool.io
    clientConfig:
      # caBundle will be updated by the kube-admission-webhook library
      service:
        name: kubemacpool-service
        namespace: kubemacpool-system
        path: "/mutate-pods"
    failurePolicy: Fail
    namespaceSelector:
      matchExpressions:
      - key: runlevel
        operator: NotIn
        values:
          - "0"
          - "1"
      - key: openshift.io/run-level
        operator: NotIn
        values:
          - "0"
          - "1"
    rules:
      - operations: ["CREATE"]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
  - name: mutatevirtualmachines.kubemacpool.io
    clientConfig:
      # caBundle will be updated by the kube-admission-webhook library
      service:
        name: kubemacpool-service
        namespace: kubemacpool-system
        path: "/mutate-virtualmachines"
    failurePolicy: Fail
    namespaceSelector:
      matchExpressions:
      - key: runlevel
        operator: NotIn
        values:
          - "0"
          - "1"
      - key: openshift.io/run-level
        operator: NotIn
        values:
          - "0"
          - "1"
    rules:
      - operations: ["CREATE", "UPDATE"]
        apiGroups: ["kubevirt.io"]
        apiVersions: ["v1alpha3"]
        resources: ["virtualmachines"]
---
apiVersion: v1
kind: Secret
metadata:
  name: service
  namespace: system
type: kubernetes.io/tls
data:
  tls.crt: YmFkIGNlcnRpZmljYXRlCg==
  tls.key: YmFkIGtleQo=
