syringe.yml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: syringesa

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: git-clone
data:
  git-clone.sh: |
    #!/bin/sh -e
    REPO=$1
    REF=$2
    DIR=$3
    # Init Containers will re-run on Pod restart. Remove the directory's contents
    # and reprovision when this happens.
    if [ -d "$DIR" ]; then
        rm -rf $( find $DIR -mindepth 1 )
    fi
    git clone $REPO $DIR
    cd $DIR
    git reset --hard $REF

---
# TODO(mierdin): This could probably use some pruning
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: syringerole
# rules:
# - apiGroups:
#   - ""
#   - "extensions"
#   - "customresourcedefinitions"
#   resources:
#   - pods
#   - services
#   - networks
#   - namespaces
#   - customresourcedefinitions
#   verbs:
#   - create
#   - list
#   - get
#   - delete
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
- nonResourceURLs:
  - '*'
  verbs:
  - '*'


---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: syringe-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: syringerole
subjects:
  - kind: ServiceAccount
    name: syringesa
    namespace: default

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata: 
  name: syringe
spec: 
  replicas: 1
  revisionHistoryLimit: 3
  template: 
    metadata:
      name: syringe
      annotations:
        foobar: ""
      labels:
        app: syringe
        antidote_role: infra
    spec:
      initContainers:
      - name: git-clone
        image: alpine/git # Any image with git will do
        command:
        - /usr/local/git/git-clone.sh
        args:
        - "https://github.com/nre-learning/antidote.git"
        - "master"
        - "/antidote"
        volumeMounts:
        - name: git-clone
          mountPath: /usr/local/git
        - name: git-volume  #?
          mountPath: /antidote
      # Might need an admission controller for this
      serviceAccount: syringesa
      containers:
      - name: syringe
        image: antidotelabs/syringe:latest
        imagePullPolicy: Always
        env:
        - name: SYRINGE_LESSONS
          value: "/antidote/lessons"
        - name: SYRINGE_IGNORE_DISABLED
          value: "true"
        - name: SYRINGE_TIER
          value: "local"
        ports:
        - containerPort: 50099  # GRPC
        - containerPort: 8086   # REST/HTTP
        readinessProbe:
          httpGet:
            path: /
            port: 8086
        volumeMounts:
          - mountPath: /antidote
            name: git-volume
      volumes:
        - name: git-volume
          emptyDir: {}
        - name: git-clone
          configMap:
            name: git-clone
            defaultMode: 0755

# /var/run/secrets/kubernetes.io/serviceaccount

# kubectl create serviceaccount syringesa
# kubectl describe serviceaccount syringesa
# kubectl get secret syringesa-token-hjdjv -oyaml

---
kind: Service
apiVersion: v1
metadata:
  name: syringe
  namespace: default
spec:
  selector:
    app: syringe
  ports:
    - name: grpc
      port: 50099
      targetPort: 50099
      # nodePort: 30010
    - name: http
      port: 8086
      targetPort: 8086
  type: ClusterIP

---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    ingress.kubernetes.io/ingress.class: "nginx"
    ingress.kubernetes.io/ssl-services: "syringe"
    ingress.kubernetes.io/ssl-redirect: "false"
    ingress.kubernetes.io/force-ssl-redirect: "false"
    ingress.kubernetes.io/rewrite-target: "/"
    nginx.ingress.kubernetes.io/rewrite-target: "/"
    # ingress.kubernetes.io/limit-connections
    # ingress.kubernetes.io/limit-rps
  name: syringe-ingress
  namespace: default
spec:
  tls:
    - hosts:
      - antidote-local
  rules:
  - host: "antidote-local"
    http:
      paths:
      - path: "/syringe"
        backend:
          serviceName: syringe
          servicePort: 8086