apiVersion: v1
kind: Namespace
metadata:
  labels:
    control-plane: mac-controller-manager
  name: kubemacpool-system
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  labels: null
  name: kubemacpool-mutator
webhooks:
- clientConfig:
    service:
      name: kubemacpool-service
      namespace: kubemacpool-system
      path: /mutate-pods
  failurePolicy: Fail
  name: mutatepods.kubemacpool.io
  namespaceSelector:
    matchExpressions:
    - key: runlevel
      operator: NotIn
      values:
      - "0"
      - "1"
    - key: openshift.io/run-level
      operator: NotIn
      values:
      - "0"
      - "1"
    - key: mutatepods.kubemacpool.io
      operator: In
      values:
      - allocate
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
- clientConfig:
    service:
      name: kubemacpool-service
      namespace: kubemacpool-system
      path: /mutate-virtualmachines
  failurePolicy: Fail
  name: mutatevirtualmachines.kubemacpool.io
  namespaceSelector:
    matchExpressions:
    - key: runlevel
      operator: NotIn
      values:
      - "0"
      - "1"
    - key: openshift.io/run-level
      operator: NotIn
      values:
      - "0"
      - "1"
    - key: mutatevirtualmachines.kubemacpool.io
      operator: NotIn
      values:
      - ignore
  rules:
  - apiGroups:
    - kubevirt.io
    apiVersions:
    - v1alpha3
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachines
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: kubemacpool-manager-role
rules:
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  - validatingwebhookconfigurations
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - get
  - list
  - create
  - update
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - pods
  - pods/status
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
- apiGroups:
  - apps
  resources:
  - deployments
  verbs:
  - get
  - create
  - update
  - patch
  - list
  - watch
- apiGroups:
  - kubevirt.io
  resources:
  - virtualmachines
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: null
  name: kubemacpool-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubemacpool-manager-role
subjects:
- kind: ServiceAccount
  name: default
  namespace: kubemacpool-system
---
apiVersion: v1
data:
  RANGE_END: 02:FF:FF:FF:FF:FF
  RANGE_START: "02:00:00:00:00:00"
kind: ConfigMap
metadata:
  labels:
    control-plane: mac-controller-manager
    controller-tools.k8s.io: "1.0"
  name: kubemacpool-mac-range-config
  namespace: kubemacpool-system
---
apiVersion: v1
data:
  tls.crt: YmFkIGNlcnRpZmljYXRlCg==
  tls.key: YmFkIGtleQo=
kind: Secret
metadata:
  name: kubemacpool-service
  namespace: kubemacpool-system
type: kubernetes.io/tls
---
apiVersion: v1
kind: Service
metadata:
  name: kubemacpool-service
  namespace: kubemacpool-system
spec:
  ports:
  - port: 443
    targetPort: 8000
  publishNotReadyAddresses: true
  selector:
    app: kubemacpool
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    control-plane: mac-controller-manager
    controller-tools.k8s.io: "1.0"
  name: kubemacpool-mac-controller-manager
  namespace: kubemacpool-system
spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: mac-controller-manager
      controller-tools.k8s.io: "1.0"
  strategy:
    type: Recreate
  template:
    metadata:
      annotations:
        description: KubeMacPool manages MAC allocation to Pods and VMs
      labels:
        app: kubemacpool
        control-plane: mac-controller-manager
        controller-tools.k8s.io: "1.0"
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: control-plane
                  operator: In
                  values:
                  - mac-controller-manager
              topologyKey: kubernetes.io/hostname
            weight: 1
      containers:
      - args:
        - --v=production
        - --wait-time=600
        command:
        - /manager
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: RANGE_START
          valueFrom:
            configMapKeyRef:
              key: RANGE_START
              name: kubemacpool-mac-range-config
        - name: RANGE_END
          valueFrom:
            configMapKeyRef:
              key: RANGE_END
              name: kubemacpool-mac-range-config
        - name: CA_ROTATE_INTERVAL
          value: 8760h0m0s
        - name: CA_OVERLAP_INTERVAL
          value: 8760h0m0s
        - name: CERT_ROTATE_INTERVAL
          value: 4380h0m0s
        image: quay.io/kubevirt/kubemacpool:latest
        imagePullPolicy: Always
        name: manager
        ports:
        - containerPort: 8000
          name: webhook-server
          protocol: TCP
        readinessProbe:
          httpGet:
            httpHeaders:
            - name: Content-Type
              value: application/json
            path: /readyz
            port: webhook-server
            scheme: HTTPS
          initialDelaySeconds: 10
          periodSeconds: 10
        resources:
          requests:
            cpu: 100m
            memory: 300Mi
        volumeMounts:
        - mountPath: /etc/webhook/certs
          name: tls-key-pair
          readOnly: true
      restartPolicy: Always
      terminationGracePeriodSeconds: 5
      volumes:
      - name: tls-key-pair
        secret:
          secretName: kubemacpool-service
