# GENERATED FILE: edits made by hand will not be preserved.
---
# Source: ambassador/templates/namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  labels:
    product: aes
  name: ambassador
---
# Source: ambassador/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ambassador
  namespace: ambassador
  labels:
    product: aes
---
# Source: ambassador/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: ambassador
  labels:
    product: aes
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ambassador
subjects:
- name: ambassador
  namespace: ambassador
  kind: ServiceAccount
---
# Source: ambassador/templates/projects-rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador-projects
  labels:
    product: aes
rules:
- apiGroups: ['']
  resources: [secrets, services]
  verbs: [get, list, create, patch, delete, watch]
- apiGroups: [apps]
  resources: [deployments]
  verbs: [get, list, create, patch, delete, watch]
- apiGroups: [batch]
  resources: [jobs]
  verbs: [get, list, create, patch, delete, watch]
- apiGroups: ['']
  resources: [pods]
  verbs: [get, list, watch]
- apiGroups: ['']
  resources: [pods/log]
  verbs: [get]
---
# Source: ambassador/templates/projects-rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: ambassador-projects
  labels:
    product: aes
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ambassador-projects
subjects:
- name: ambassador
  namespace: ambassador
  kind: ServiceAccount
---
# Source: ambassador/templates/aes-redis.yaml
apiVersion: v1
kind: Service
metadata:
  name: ambassador-redis
  namespace: ambassador
  labels:
    product: aes
  annotations:
    a8r.io/owner: Ambassador Labs
    a8r.io/repository: github.com/datawire/ambassador
    a8r.io/description: The Ambassador Edge Stack Redis store for auth and rate limiting,
      among other things.
    a8r.io/documentation: https://www.getambassador.io/docs/edge-stack/latest/
    a8r.io/chat: http://a8r.io/Slack
    a8r.io/bugs: https://github.com/datawire/ambassador/issues
    a8r.io/support: https://www.getambassador.io/about-us/support/
    a8r.io/dependencies: None
spec:
  type: ClusterIP
  ports:
  - port: 6379
    targetPort: 6379
  selector:
    service: ambassador-redis
---
# Source: ambassador/templates/aes-redis.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ambassador-redis
  namespace: ambassador
  labels:
    product: aes
  annotations: {}
spec:
  replicas: 1
  selector:
    matchLabels:
      service: ambassador-redis
  template:
    metadata:
      labels:
        service: ambassador-redis
    spec:
      containers:
      - name: redis
        image: redis:5.0.1
        imagePullPolicy: IfNotPresent
        resources: {}
      restartPolicy: Always
---
# Source: ambassador/templates/aes-ratelimit.yaml
apiVersion: getambassador.io/v2
kind: RateLimitService
metadata:
  name: ambassador-edge-stack-ratelimit
  namespace: ambassador
  labels:
    product: aes
spec:
  service: 127.0.0.1:8500
---
# Source: ambassador/templates/aes-authservice.yaml
apiVersion: getambassador.io/v2
kind: AuthService
metadata:
  name: ambassador-edge-stack-auth
  namespace: ambassador
  labels:
    product: aes
spec:
  proto: grpc
  auth_service: 127.0.0.1:8500
  allow_request_body: false
  status_on_error:
    code: 504
---
# Source: ambassador/templates/aes-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: ambassador-edge-stack
  namespace: ambassador
type: Opaque
data:
  license-key: ''
---
# Source: ambassador/templates/aes-internal.yaml
# Configure DevPortal
apiVersion: getambassador.io/v2
kind: Mapping
metadata:
  # This Mapping name is referenced by convention, it's important to leave as-is.
  name: ambassador-devportal
  namespace: ambassador
  labels:
    product: aes
spec:
  prefix: /docs/
  rewrite: /docs/
  service: 127.0.0.1:8500
---
# Source: ambassador/templates/aes-internal.yaml
apiVersion: getambassador.io/v2
kind: Mapping
metadata:
  name: ambassador-devportal-assets
  namespace: ambassador
  labels:
    product: aes
spec:
  prefix: /documentation/(assets|styles)/(.*)(.css)
  prefix_regex: true
  regex_rewrite:
    pattern: /documentation/(.*)
    substitution: /docs/\1
  service: 127.0.0.1:8500
  add_response_headers:
    cache-control:
      value: public, max-age=3600, immutable
      append: false
---
# Source: ambassador/templates/aes-internal.yaml
apiVersion: getambassador.io/v2
kind: Mapping
metadata:
  # This Mapping name is referenced by convention, it's important to leave as-is.
  name: ambassador-devportal-api
  namespace: ambassador
  labels:
    product: aes
spec:
  prefix: /openapi/
  rewrite: ''
  service: 127.0.0.1:8500
---
# Source: ambassador/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: ambassador
  namespace: ambassador
  labels:
    app.kubernetes.io/component: ambassador-service
    product: aes
  annotations:
    a8r.io/owner: Ambassador Labs
    a8r.io/repository: github.com/datawire/ambassador
    a8r.io/description: The Ambassador Edge Stack goes beyond traditional API Gateways
      and Ingress Controllers with the advanced edge features needed to support developer
      self-service and full-cycle development.
    a8r.io/documentation: https://www.getambassador.io/docs/edge-stack/latest/
    a8r.io/chat: http://a8r.io/Slack
    a8r.io/bugs: https://github.com/datawire/ambassador/issues
    a8r.io/support: https://www.getambassador.io/about-us/support/
    a8r.io/dependencies: ambassador-redis.ambassador
spec:
  type: LoadBalancer
  ports:
  - name: http
    port: 80
    targetPort: 8080
  - name: https
    port: 443
    targetPort: 8443
  selector:
    service: ambassador
---
# Source: ambassador/templates/admin-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: ambassador-admin
  namespace: ambassador
  labels:
    # Hard-coded label for Prometheus Operator ServiceMonitor
    service: ambassador-admin
    product: aes
  annotations:
    a8r.io/owner: Ambassador Labs
    a8r.io/repository: github.com/datawire/ambassador
    a8r.io/description: The Ambassador Edge Stack admin service for internal use and
      health checks.
    a8r.io/documentation: https://www.getambassador.io/docs/edge-stack/latest/
    a8r.io/chat: http://a8r.io/Slack
    a8r.io/bugs: https://github.com/datawire/ambassador/issues
    a8r.io/support: https://www.getambassador.io/about-us/support/
    a8r.io/dependencies: None
spec:
  type: ClusterIP
  ports:
  - port: 8877
    targetPort: admin
    protocol: TCP
    name: ambassador-admin
  - port: 8005
    targetPort: 8005
    protocol: TCP
    name: ambassador-snapshot
  selector:
    service: ambassador
---
# Source: ambassador/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador
  labels:
    product: aes
aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      rbac.getambassador.io/role-group: ambassador
rules: []
---
# Source: ambassador/templates/rbac.yaml
# CRDs are cluster scoped resources, so they need to be in a cluster role,
# even if ambassador is running in single namespace mode
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador-crd
  labels:
    product: aes
    rbac.getambassador.io/role-group: ambassador
rules:
- apiGroups: [apiextensions.k8s.io]
  resources: [customresourcedefinitions]
  verbs: [get, list, watch, delete]
---
# Source: ambassador/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador-watch
  labels:
    product: aes
    rbac.getambassador.io/role-group: ambassador
rules:
- apiGroups: ['']
  resources:
  - namespaces
  - services
  - secrets
  - endpoints
  verbs: [get, list, watch]

- apiGroups: [getambassador.io]
  resources: ['*']
  verbs: [get, list, watch, update, patch, create, delete]

- apiGroups: [getambassador.io]
  resources: [mappings/status]
  verbs: [update]

- apiGroups: [networking.internal.knative.dev]
  resources: [clusteringresses, ingresses]
  verbs: [get, list, watch]

- apiGroups: [networking.x-k8s.io]
  resources: ['*']
  verbs: [get, list, watch]

- apiGroups: [networking.internal.knative.dev]
  resources: [ingresses/status, clusteringresses/status]
  verbs: [update]

- apiGroups: [extensions, networking.k8s.io]
  resources: [ingresses, ingressclasses]
  verbs: [get, list, watch]

- apiGroups: [extensions, networking.k8s.io]
  resources: [ingresses/status]
  verbs: [update]

- apiGroups: ['']
  resources: [secrets]
  verbs: [get, list, watch, create, update]

- apiGroups: ['']
  resources: [events]
  verbs: [get, list, watch, create, patch]

- apiGroups: [coordination.k8s.io]
  resources: [leases]
  verbs: [get, create, update]

- apiGroups: ['']
  resources: [endpoints]
  verbs: [get, list, watch, create, update]
---
# Source: ambassador/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ambassador
  namespace: ambassador
  labels:
    product: aes
spec:
  replicas: 1
  selector:
    matchLabels:
      service: ambassador


  progressDeadlineSeconds: 600
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        service: ambassador
        app.kubernetes.io/managed-by: getambassador.io
      annotations:
        consul.hashicorp.com/connect-inject: 'false'
        sidecar.istio.io/inject: 'false'
    spec:
      terminationGracePeriodSeconds: 0
      securityContext:
        runAsUser: 8888
      restartPolicy: Always
      serviceAccountName: ambassador
      volumes:
      - name: ambassador-pod-info
        downwardAPI:
          items:
          - fieldRef:
              fieldPath: metadata.labels
            path: labels
      - name: ambassador-edge-stack-secrets
        secret:
          secretName: ambassador-edge-stack
      containers:
      - name: aes
        image: docker.io/datawire/aes:1.14.4
        imagePullPolicy: IfNotPresent
        ports:
        - name: http
          containerPort: 8080
        - name: https
          containerPort: 8443
        - name: admin
          containerPort: 8877
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: REDIS_URL
          value: ambassador-redis:6379
        - name: AMBASSADOR_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: AMBASSADOR_DRAIN_TIME
          value: '600'
        - name: AMBASSADOR_INTERNAL_URL
          value: https://127.0.0.1:8443
        - name: AMBASSADOR_URL
          value: https://ambassador.ambassador.svc.cluster.local
        - name: POLL_EVERY_SECS
          value: '60'
        securityContext:
          allowPrivilegeEscalation: false
        livenessProbe:
          httpGet:
            path: /ambassador/v0/check_alive
            port: admin
          failureThreshold: 3
          initialDelaySeconds: 30
          periodSeconds: 3
        readinessProbe:
          httpGet:
            path: /ambassador/v0/check_ready
            port: admin
          failureThreshold: 3
          initialDelaySeconds: 30
          periodSeconds: 3
        volumeMounts:
        - name: ambassador-pod-info
          mountPath: /tmp/ambassador-pod-info
          readOnly: true
        - name: ambassador-edge-stack-secrets
          mountPath: /.config/ambassador
          readOnly: true
        resources:
          limits:
            cpu: 1000m
            memory: 600Mi
          requests:
            cpu: 200m
            memory: 300Mi
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchLabels:
                  service: ambassador
              topologyKey: kubernetes.io/hostname
            weight: 100
      imagePullSecrets: []
      dnsPolicy: ClusterFirst
      hostNetwork: false
---
# Source: ambassador/templates/ambassador-agent.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ambassador-agent
  namespace: ambassador
  labels:
    product: aes
---
# Source: ambassador/templates/ambassador-agent.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: ambassador-agent
  labels:
    product: aes
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ambassador-agent
subjects:
- kind: ServiceAccount
  name: ambassador-agent
  namespace: ambassador
---
# Source: ambassador/templates/ambassador-agent.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador-agent
  labels:
    product: aes
aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      rbac.getambassador.io/role-group: ambassador-agent
rules: []
---
# Source: ambassador/templates/ambassador-agent.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador-agent-pods
  labels:
    rbac.getambassador.io/role-group: ambassador-agent
    product: aes
rules:
- apiGroups: ['']
  resources: [pods]
  verbs: [get, list, watch]
---
# Source: ambassador/templates/ambassador-agent.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador-agent-deployments
  labels:
    rbac.getambassador.io/role-group: ambassador-agent
    product: aes
rules:
- apiGroups: [apps, extensions]
  resources: [deployments]
  verbs: [get, list, watch]
---
# Source: ambassador/templates/ambassador-agent.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador-agent-endpoints
  labels:
    rbac.getambassador.io/role-group: ambassador-agent
    product: aes
rules:
- apiGroups: ['']
  resources: [endpoints]
  verbs: [get, list, watch]
---
# Source: ambassador/templates/ambassador-agent.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador-agent-configmaps
  labels:
    rbac.getambassador.io/role-group: ambassador-agent
    product: aes
rules:
- apiGroups: ['']
  resources: [configmaps]
  verbs: [get, list, watch]
---
# Source: ambassador/templates/ambassador-agent.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador-agent-rollouts
  labels:
    rbac.getambassador.io/role-group: ambassador-agent
    product: aes
rules:
- apiGroups: [argoproj.io]
  resources: [rollouts]
  verbs: [get, list, watch]
---
# Source: ambassador/templates/ambassador-agent.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador-agent-applications
  labels:
    rbac.getambassador.io/role-group: ambassador-agent
    product: aes
rules:
- apiGroups: [argoproj.io]
  resources: [applications]
  verbs: [get, list, watch]
---
# Source: ambassador/templates/ambassador-agent.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name: ambassador-agent-config
  namespace: ambassador
  labels:
    product: aes
rules:
- apiGroups: ['']
  resources: [configmaps]
  verbs: [get, list, watch]
---
# Source: ambassador/templates/ambassador-agent.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: ambassador-agent-config
  namespace: ambassador
  labels:
    product: aes
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ambassador-agent-config
subjects:
- kind: ServiceAccount
  name: ambassador-agent
  namespace: ambassador
---
# Source: ambassador/templates/ambassador-agent.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ambassador-agent
  namespace: ambassador
  labels:
    app.kubernetes.io/name: ambassador-agent
    app.kubernetes.io/instance: ambassador
spec:
  replicas: 1


  progressDeadlineSeconds: 600
  selector:
    matchLabels:
      app.kubernetes.io/name: ambassador-agent
      app.kubernetes.io/instance: ambassador
  template:
    metadata:
      labels:
        app.kubernetes.io/name: ambassador-agent
        app.kubernetes.io/instance: ambassador
    spec:
      serviceAccountName: ambassador-agent
      containers:
      - name: agent
        image: docker.io/datawire/aes:1.14.4
        imagePullPolicy: IfNotPresent
        command: [agent]
        env:
        - name: AGENT_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: AGENT_CONFIG_RESOURCE_NAME
          value: ambassador-agent-cloud-token
        - name: RPC_CONNECTION_ADDRESS
          value: https://app.getambassador.io/
        - name: AES_SNAPSHOT_URL
          value: http://ambassador-admin.ambassador:8005/snapshot-external
