# This is a tech-preview manifest which installs the Calico API server. Note that this manifest is liable to change
# or be removed in future releases without further warning.
#
# Namespace and namespace-scoped resources.
apiVersion: v1
kind: Namespace
metadata:
  labels:
    name: calico-apiserver
  name: calico-apiserver
spec:

---
# Policy to ensure the API server isn't cut off. Can be modified, but ensure
# that the main API server is always able to reach the Calico API server.
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-apiserver
  namespace: calico-apiserver
spec:
  podSelector:
    matchLabels:
      apiserver: "true"
  ingress:
    - ports:
        - protocol: TCP
          port: 5443

---
apiVersion: v1
kind: Service
metadata:
  name: calico-api
  namespace: calico-apiserver
spec:
  ports:
    - name: apiserver
      port: 443
      protocol: TCP
      targetPort: 5443
  selector:
    apiserver: "true"
  type: ClusterIP

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    apiserver: "true"
    k8s-app: calico-apiserver
  name: calico-apiserver
  namespace: calico-apiserver
spec:
  replicas: 1
  selector:
    matchLabels:
      apiserver: "true"
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        apiserver: "true"
        k8s-app: calico-apiserver
      name: calico-apiserver
      namespace: calico-apiserver
    spec:
      containers:
        - args:
            - --secure-port=5443
            - -v=5
          env:
            - name: DATASTORE_TYPE
              value: kubernetes
          image: calico/apiserver:master
          name: calico-apiserver
          readinessProbe:
            httpGet:
              path: /readyz
              port: 5443
              scheme: HTTPS
            timeoutSeconds: 5
            periodSeconds: 60
          securityContext:
            privileged: false
            runAsUser: 0
          volumeMounts:
            - mountPath: /code/apiserver.local.config/certificates
              name: calico-apiserver-certs
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      restartPolicy: Always
      serviceAccount: calico-apiserver
      serviceAccountName: calico-apiserver
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
        - effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
      volumes:
        - name: calico-apiserver-certs
          secret:
            secretName: calico-apiserver-certs

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: calico-apiserver
  namespace: calico-apiserver

---
# Cluster-scoped resources below here.
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v3.projectcalico.org
spec:
  group: projectcalico.org
  groupPriorityMinimum: 1500
  service:
    name: calico-api
    namespace: calico-apiserver
    port: 443
  version: v3
  versionPriority: 200

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: calico-crds
rules:
  - apiGroups:
      - extensions
      - networking.k8s.io
      - ""
    resources:
      - networkpolicies
      - nodes
      - namespaces
      - pods
      - serviceaccounts
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - crd.projectcalico.org
    resources:
      - globalnetworkpolicies
      - networkpolicies
      - clusterinformations
      - hostendpoints
      - globalnetworksets
      - networksets
      - bgpconfigurations
      - bgppeers
      - bgpfilters
      - felixconfigurations
      - kubecontrollersconfigurations
      - ippools
      - ipreservations
      - ipamblocks
      - blockaffinities
      - caliconodestatuses
      - ipamconfigs
      - tiers
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - delete
  - apiGroups:
      - policy
    resourceNames:
      - calico-apiserver
    resources:
      - podsecuritypolicies
    verbs:
      - use

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: calico-extension-apiserver-auth-access
rules:
  - apiGroups:
      - ""
    resourceNames:
      - extension-apiserver-authentication
    resources:
      - configmaps
    verbs:
      - list
      - watch
      - get
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - clusterroles
      - clusterrolebindings
      - roles
      - rolebindings
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - validatingadmissionpolicies
      - validatingadmissionpolicybindings
    verbs:
      - get
      - list
      - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: calico-webhook-reader
rules:
  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - mutatingwebhookconfigurations
      - validatingwebhookconfigurations
    verbs:
      - get
      - list
      - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: calico-apiserver-access-crds
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: calico-crds
subjects:
  - kind: ServiceAccount
    name: calico-apiserver
    namespace: calico-apiserver

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: calico-apiserver-delegate-auth
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    name: calico-apiserver
    namespace: calico-apiserver

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: calico-apiserver-webhook-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: calico-webhook-reader
subjects:
  - kind: ServiceAccount
    name: calico-apiserver
    namespace: calico-apiserver

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: calico-extension-apiserver-auth-access
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: calico-extension-apiserver-auth-access
subjects:
  - kind: ServiceAccount
    name: calico-apiserver
    namespace: calico-apiserver
