tesoro-bundle.yml

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    manifests.kapicorp.com/generated: 'true'
  labels:
    name: tesoro
  name: tesoro
  namespace: tesoro
spec:
  replicas: 1
  selector:
    matchLabels:
      name: tesoro
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        name: tesoro
    spec:
      containers:
        - args:
            - --ca-file=/certs/cacert.pem
            - --cert-file=/certs/cert.pem
            - --key-file=/certs/cert.key
            - --port=443
          image: kapicorp/tesoro
          imagePullPolicy: IfNotPresent
          name: tesoro
          ports:
            - containerPort: 443
              name: tesoro-api
              protocol: TCP
            - containerPort: 9095
              name: tesoro-metrics
              protocol: TCP
          securityContext:
            capabilities:
              add:
                - NET_BIND_SERVICE
              drop:
                - all
          volumeMounts:
            - mountPath: /certs
              name: secrets
      restartPolicy: Always
      serviceAccountName: tesoro
      terminationGracePeriodSeconds: 30
      volumes:
        - name: secrets
          secret:
            defaultMode: 420
            secretName: tesoro
---
apiVersion: v1
kind: Service
metadata:
  labels:
    name: tesoro
  name: tesoro
  namespace: tesoro
spec:
  ports:
    - name: tesoro-api
      port: 443
      protocol: TCP
      targetPort: tesoro-api
    - name: tesoro-metrics
      port: 9095
      protocol: TCP
      targetPort: tesoro-metrics
  selector:
    name: tesoro
  sessionAffinity: None
  type: ClusterIP
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  labels:
    name: tesoro
  name: tesoro
webhooks:
  - clientConfig:
      caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUV1akNDQXFJQ0NRRDZIdzJDZld6ZVp6QU5CZ2txaGtpRzl3MEJBUXNGQURBZk1SMHdHd1lEVlFRRERCUkQKUVMxMFpYTnZjbTh1ZEdWemIzSnZMbk4yWXpBZUZ3MHlNREV4TWpFeU1ERTVNemhhRncweU16QTVNVEV5TURFNQpNemhhTUI4eEhUQWJCZ05WQkFNTUZFTkJMWFJsYzI5eWJ5NTBaWE52Y204dWMzWmpNSUlDSWpBTkJna3Foa2lHCjl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUEzbVlZNXIvTVYrSU9hMy9DZGxuRGVrdk9yQnVpeUd5MXUwZUYKOHU2RGQzdkNRcnp3MytLUmZrSXlHOW1lcDl3NW16bm5IMjdDZzVDN0t5Y040NVRaTnE3cHFESmhHVXVMWC9uRwpqNmxvM01qdnVpS0dtTG5JaHlEVjQyS1hDamxnbWVRaGhOdjFScFQ0cTFZeWhBWlF5RDU1a2FHUHQ0UmtQd21pCnkxMU04TTBXTUZDeW50OFhYZUNqcHVYVXdTV1V3cVE2ZVNJRFFnM1d1cnp6V1dJbVVwWTNPUDVTVWNYSHhFd2UKakFaT1hqSEJkZzJwWHVFK2hYN2VwektJUXMwbkpnbmFtakVPRlZhNnMxNDlEWkpjOU82VTg4dmVJMTNyZ3A4QwpPVUphdUlDOHBQNDdyZ2xadkNadEo2YmRPSDhaK1E2SEl1UGRic2tUM2JkS1dlTmMzTnBZSGI5U0tRNW82M3NqCmhBWUNpU3Q4YUVjbEtLdDF6U0xXMm5qZkU5NVhjZndyU25BRlNvU1pFdyt6RnNZbkxwMEdmWDlaWllPM1kzRzYKM2lPUjM4alRzMkpuamU0R1RxQ0Y1V1JMVUpZdU1jNTMwZTlDOWxjaTFYZ21WdkVtbCsrNUpkalN5dkdtSnBDQwpEMitKemR4WlJ4dE9tRkdVWnJKQVBsR2hqK0hXNGpEUHBDTnJ4VlhJdjJQSWhIWVdiTEhqNU9CVFNUM2xaTk0xCjY0ZFV6a3ZveDhBOThzcUlQM0JYdEVOU21qSDJkK25jYjREcTJsVWhwbWs2ZmE1WWN6YXpET3lESHRPa3pZSlMKRmtQaHMwOHFSTTZPclc5WlVPUGJMVmcvSllKUHB3NVRtZ3dNTUVLVXFtNzhob3drK1B3ejRxYUVyanNzb3djZwpqaDdudkdNQ0F3RUFBVEFOQmdrcWhraUc5dzBCQVFzRkFBT0NBZ0VBUEJMWEcvREZ3U3JYV1pGMU9nNGpVWnlXCjV4NTUxT1NNbVNJOUc0ZllhaGY5dEYrME9aTFpBYUxCdlhCNUNNK1lWajRDWDl1V3Y0NGlDZW5EZDY1T1l0dkoKTU1nM2tyWGV2dWFVOUEyeVVSMEdZWHhSWHJ2ZTFQY1JBK1V3bE1ldkd5aHpHR1hMSjg0dHRka2I5OGZad3VlTwp2aG0wOWl3RDcxTmtMeGJKVGVSQk5DUFZVcmVBZUQ1SVYvUjlJZTE5akhIOU5STzFMZ1l0SDNhODRvNTYzUXR1CkNpcGtNZ0s2L1pFSFlVZnZMOVo4MjlyYkFqM1hWVXdOSGsvTk5CR2czZDFWcHpPenNZMFBRa01aTitGU0NTYkcKdWhSbHdvc2N6R09qclBDcDlpbWVPT0llQlZJY0NBcUpuSnE1ZlVCSzF2OSs3RDRFMGdSR3hXbXVrV2xxYTQ2KwozcHg1RUdZajN4c1AveTVnWDg3cGsrQnRBcVBJUGJtOGQ4MWo3dTVGYUVScTViaEcwQkplNG83U25Ed0VNWkRKCnJPdlMxZWh6N29XM2RxYmxNODNLRjM3b0xzNFlDSURXckp3SFYwVThHa0hWQTZMdU1lM05Sc3Y1WGRZL2QydEoKSlhLNFFYL082WWlHRFpCeGtlZVJDVzMwWFhMTWw1REJWTUFGK2o2WUg1M3BjSnE4R2NHdkVDUk8zSGxCSmJVMwp2a3FFVFV0L1Q3ZE5LRFFISzM2azhuMWdlTEhJVndqRm16NHIzdkVieWdZZUlNVGRaZTQ3c2hTcjhTajNITm4rCklWRnhSZlV4anpuTXdSNjB3bm5JVk5lM2t0YmFMM1lFMFFmdnJiV2xaanAwZG1zQWh6UE5qYWJob0JBVFVCVWUKd0NpMk5vQzVJRU5pSU1MY1VjUT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
      service:
        name: tesoro
        namespace: tesoro
        path: /mutate
    failurePolicy: Fail
    name: tesoro.kapicorp.com
    objectSelector:
      matchLabels:
        tesoro.kapicorp.com: enabled
    rules:
      - apiGroups:
          - ''
        apiVersions:
          - '*'
        operations:
          - CREATE
          - UPDATE
        resources:
          - '*'
      - apiGroups:
          - apps
        apiVersions:
          - '*'
        operations:
          - CREATE
          - UPDATE
        resources:
          - deployments
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  labels:
    name: tesoro-metrics
  name: tesoro-metrics
  namespace: tesoro
spec:
  endpoints:
    - interval: 15s
      path: /
      targetPort: 9095
  jobLabel: tesoro-metrics
  namespaceSelector:
    matchNames:
      - tesoro
  selector:
    matchLabels:
      name: tesoro
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  labels:
    name: tesoro.rules
  name: tesoro.rules
  namespace: tesoro
spec:
  groups:
    - name: tesoro.rules
      rules:
        - alert: TesoroFailedRequests
          annotations:
            message: tesoro_requests_failed_total has increased above 0
          expr: sum by (job, namespace, service, env) (increase(tesoro_requests_failed_total[5m]))
            > 0
          for: 1m
          labels:
            severity: warning
        - alert: KapitanRevealRequestFailures
          annotations:
            message: kapitan_reveal_requests_failed_total has increased above 0
          expr: sum by (job, namespace, service, env) (increase(kapitan_reveal_requests_failed_total[5m]))
            > 0
          for: 1m
          labels:
            severity: warning
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  labels:
    name: tesoro
  name: tesoro
rules:
  - apiGroups:
      - ''
    resources:
      - pods
      - events
      - secrets
      - configmaps
    verbs:
      - '*'
  - apiGroups:
      - apps
    resources:
      - deployments
      - daemonsets
      - replicasets
      - statefulsets
    verbs:
      - '*'
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  labels:
    name: tesoro
  name: tesoro
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tesoro
subjects:
  - kind: ServiceAccount
    name: tesoro
    namespace: tesoro