apiVersion: v1
kind: ServiceAccount
metadata:
  name: qualification-ingress
  namespace: remora-testbed
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: qualification-ingress
  namespace: remora-testbed
rules:
  - apiGroups: [""]
    resources: [configmaps, pods, secrets, endpoints]
    verbs: [get, list, watch]
  - apiGroups: [""]
    resources: [services]
    verbs: [get, list, watch]
  - apiGroups: [networking.k8s.io]
    resources: [ingresses, ingressclasses]
    verbs: [get, list, watch]
  - apiGroups: [networking.k8s.io]
    resources: [ingresses/status]
    verbs: [update]
  - apiGroups: [coordination.k8s.io]
    resources: [leases]
    verbs: [get, create, update]
  - apiGroups: [""]
    resources: [events]
    verbs: [create, patch]
  - apiGroups: [discovery.k8s.io]
    resources: [endpointslices]
    verbs: [get, list, watch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: remora-qualification-ingress
rules:
  - apiGroups: [""]
    resources: [configmaps, endpoints, nodes, pods, secrets, namespaces]
    verbs: [list, watch]
  - apiGroups: [""]
    resources: [nodes]
    verbs: [get]
  - apiGroups: [""]
    resources: [services]
    verbs: [get, list, watch]
  - apiGroups: [networking.k8s.io]
    resources: [ingresses, ingressclasses]
    verbs: [get, list, watch]
  - apiGroups: [networking.k8s.io]
    resources: [ingresses/status]
    verbs: [update]
  - apiGroups: [coordination.k8s.io]
    resources: [leases]
    verbs: [list, watch]
  - apiGroups: [""]
    resources: [events]
    verbs: [create, patch]
  - apiGroups: [discovery.k8s.io]
    resources: [endpointslices]
    verbs: [get, list, watch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: qualification-ingress
  namespace: remora-testbed
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: qualification-ingress
subjects:
  - kind: ServiceAccount
    name: qualification-ingress
    namespace: remora-testbed
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: remora-qualification-ingress
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: remora-qualification-ingress
subjects:
  - kind: ServiceAccount
    name: qualification-ingress
    namespace: remora-testbed
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: qualification-ingress
  namespace: remora-testbed
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: qualification-nginx
spec:
  controller: remora.dev/qualification-ingress
---
apiVersion: v1
kind: Service
metadata:
  name: qualification-ingress
  namespace: remora-testbed
spec:
  selector:
    app.kubernetes.io/name: qualification-ingress
  ports:
    - {name: http, port: 80, targetPort: http}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: qualification-ingress
  namespace: remora-testbed
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: qualification-ingress
  template:
    metadata:
      labels:
        app.kubernetes.io/name: qualification-ingress
    spec:
      serviceAccountName: qualification-ingress
      containers:
        - name: controller
          image: @@INGRESS_IMAGE@@
          imagePullPolicy: Never
          args:
            - /nginx-ingress-controller
            - --election-id=qualification-ingress
            - --controller-class=remora.dev/qualification-ingress
            - --ingress-class=qualification-nginx
            - --configmap=$(POD_NAMESPACE)/qualification-ingress
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - {name: LD_PRELOAD, value: /usr/local/lib/libmimalloc.so}
          ports:
            - {name: http, containerPort: 80}
          readinessProbe:
            httpGet: {path: /healthz, port: 10254}
            initialDelaySeconds: 5
            periodSeconds: 2
          resources:
            requests: {cpu: 100m, memory: 90Mi}
            limits: {cpu: "1", memory: 256Mi}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add: [NET_BIND_SERVICE]
              drop: [ALL]
            runAsGroup: 82
            runAsNonRoot: true
            runAsUser: 101
            seccompProfile: {type: RuntimeDefault}
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: qualification-remora-route
  namespace: remora-testbed
spec:
  ingressClassName: qualification-nginx
  rules:
    - host: qualification-ingress
      http:
        paths:
          - path: /v1
            pathType: Prefix
            backend:
              service:
                name: remora-remora
                port:
                  name: http
          - path: /
            pathType: Prefix
            backend:
              service:
                name: remora-remora-web
                port:
                  name: http