agent-tls-template.yml

---
apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: maestro-agent
  annotations:
    openshift.io/display-name: maestro-agent
    description: agent to connect to maestro service.
    tags: maestro-agent
    iconClass: icon-shadowman
    template.openshift.io/provider-display-name: Red Hat, Inc.
    template.openshift.io/documentation-url: https://gitlab.cee.redhat.com/service/
labels:
  template: maestro-agent
parameters:

- name: ENVIRONMENT
  displayName: Environment
  description: Which maestro environment to use for this deployment
  value: production

- name: AGENT_NAMESPACE
  description: namespace of maestro agent

- name: CONSUMER_NAME
  displayName: Treat CONSUMER_NAME as cluster name
  required: true

- name: IMAGE_REGISTRY
  displayName: Image Registry
  required: true

- name: IMAGE_REPOSITORY
  displayName: Image Repository
  required: true

- name: IMAGE_TAG
  displayName: Image tag
  value: latest

- name: KLOG_V
  displayName: KLOG V Level
  description: Log verbosity level
  value: "2"

- name: MESSAGE_DRIVER_TYPE
  displayName: Message Driver Type
  description: Message driver type, mqtt or grpc.
  value: mqtt

- name: MQTT_HOST
  description: Hostname for the mqtt broker.

- name: MQTT_PORT
  description: Port for the mqtt broker.

- name: MQTT_USER
  description: User for the mqtt broker.

- name: MQTT_PASSWORD
  description: Password for the mqtt broker.

- name: MQTT_ROOT_CERT
  description: Root Certificate for the mqtt broker.

- name: MQTT_CLENT_CERT
  description: Client certificate to access the mqtt broker.

- name: MQTT_CLENT_KEY
  description: Client private key to access the mqtt broker.

objects:
- apiVersion: apiextensions.k8s.io/v1
  kind: CustomResourceDefinition
  metadata:
    name: appliedmanifestworks.work.open-cluster-management.io
  spec:
    group: work.open-cluster-management.io
    names:
      kind: AppliedManifestWork
      listKind: AppliedManifestWorkList
      plural: appliedmanifestworks
      singular: appliedmanifestwork
    scope: Cluster
    preserveUnknownFields: false
    versions:
      - name: v1
        schema:
          openAPIV3Schema:
            description: AppliedManifestWork represents an applied manifestwork on managed cluster that is placed on a managed cluster. An AppliedManifestWork links to a manifestwork on a hub recording resources deployed in the managed cluster. When the agent is removed from managed cluster, cluster-admin on managed cluster can delete appliedmanifestwork to remove resources deployed by the agent. The name of the appliedmanifestwork must be in the format of {hash of hub's first kube-apiserver url}-{manifestwork name}
            type: object
            properties:
              apiVersion:
                description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
                type: string
              kind:
                description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                type: string
              metadata:
                type: object
              spec:
                description: Spec represents the desired configuration of AppliedManifestWork.
                type: object
                properties:
                  agentID:
                    description: AgentID represents the ID of the work agent who is to handle this AppliedManifestWork.
                    type: string
                  hubHash:
                    description: HubHash represents the hash of the first hub kube apiserver to identify which hub this AppliedManifestWork links to.
                    type: string
                  manifestWorkName:
                    description: ManifestWorkName represents the name of the related manifestwork on the hub.
                    type: string
              status:
                description: Status represents the current status of AppliedManifestWork.
                type: object
                properties:
                  appliedResources:
                    description: AppliedResources represents a list of resources defined within the manifestwork that are applied. Only resources with valid GroupVersionResource, namespace, and name are suitable. An item in this slice is deleted when there is no mapped manifest in manifestwork.Spec or by finalizer. The resource relating to the item will also be removed from managed cluster. The deleted resource may still be present until the finalizers for that resource are finished. However, the resource will not be undeleted, so it can be removed from this list and eventual consistency is preserved.
                    type: array
                    items:
                      description: AppliedManifestResourceMeta represents the group, version, resource, name and namespace of a resource. Since these resources have been created, they must have valid group, version, resource, namespace, and name.
                      type: object
                      required:
                        - name
                        - resource
                        - version
                      properties:
                        group:
                          description: Group is the API Group of the Kubernetes resource, empty string indicates it is in core group.
                          type: string
                        name:
                          description: Name is the name of the Kubernetes resource.
                          type: string
                        namespace:
                          description: Name is the namespace of the Kubernetes resource, empty string indicates it is a cluster scoped resource.
                          type: string
                        resource:
                          description: Resource is the resource name of the Kubernetes resource.
                          type: string
                        uid:
                          description: UID is set on successful deletion of the Kubernetes resource by controller. The resource might be still visible on the managed cluster after this field is set. It is not directly settable by a client.
                          type: string
                        version:
                          description: Version is the version of the Kubernetes resource.
                          type: string
                  evictionStartTime:
                    description: 'EvictionStartTime represents the current appliedmanifestwork will be evicted after a grace period. An appliedmanifestwork will be evicted from the managed cluster in the following two scenarios:   - the manifestwork of the current appliedmanifestwork is missing on the hub, or   - the appliedmanifestwork hub hash does not match the current hub hash of the work agent.'
                    type: string
                    format: date-time
        served: true
        storage: true
        subresources:
          status: {}
  status:
    acceptedNames:
      kind: ""
      plural: ""
    conditions: []
    storedVersions: []

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: maestro-agent:agent
  rules:
  # Allow agent to managed appliedmanifestworks
  - apiGroups: ["work.open-cluster-management.io"]
    resources: ["appliedmanifestworks"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["work.open-cluster-management.io"]
    resources: ["appliedmanifestworks/status"]
    verbs: ["patch", "update"]
  - apiGroups: ["work.open-cluster-management.io"]
    resources: ["appliedmanifestworks/finalizers"]
    verbs: ["update"]
  # Allow agent to check executor permissions
  - apiGroups: ["authorization.k8s.io"]
    resources: ["subjectaccessreviews"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["serviceaccounts"]
    verbs: ["impersonate"]

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: maestro-agent:agent
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: maestro-agent:agent
  subjects:
    - kind: ServiceAccount
      name: maestro-agent-sa
      namespace: ${AGENT_NAMESPACE}

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: maestro-agent:execution-admin
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    # We deploy a controller that could work with permission lower than cluster-admin, the tradeoff is
    # responsivity because list/watch cannot be maintained over too many namespaces.
    name: cluster-admin
  subjects:
    - kind: ServiceAccount
      name: maestro-agent-sa
      namespace: ${AGENT_NAMESPACE}

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: maestro-agent:execution
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: maestro-agent:execution
  subjects:
    - kind: ServiceAccount
      name: maestro-agent-sa
      namespace: ${AGENT_NAMESPACE}

- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: maestro-agent:agent
    namespace: ${AGENT_NAMESPACE}
  rules:
  # leader election needs to operate configmaps
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["create", "get", "list", "update", "watch", "patch"]
  - apiGroups: ["", "events.k8s.io"]
    resources: ["events"]
    verbs: ["create", "patch", "update"]

- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: maestro-agent:agent
    namespace: ${AGENT_NAMESPACE}
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: maestro-agent:agent
  subjects:
    - kind: ServiceAccount
      name: maestro-agent-sa
      namespace: ${AGENT_NAMESPACE}

- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: maestro-agent:agent:extension-apiserver
    namespace: kube-system
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: maestro-agent:agent:extension-apiserver
  subjects:
    - kind: ServiceAccount
      name: maestro-agent-sa
      namespace: ${AGENT_NAMESPACE}

- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: maestro-agent:agent:extension-apiserver
    namespace: kube-system
  rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["extension-apiserver-authentication"]
    verbs: ["get", "list", "watch"]

- kind: Deployment
  apiVersion: apps/v1
  metadata:
    name: maestro-agent
    labels:
      app: maestro-agent
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: maestro-agent
    template:
      metadata:
        labels:
          app: maestro-agent
      spec:
        serviceAccountName: maestro-agent-sa
        containers:
        - name: maestro-agent
          image: ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}:${IMAGE_TAG}
          imagePullPolicy: IfNotPresent
          env:
            - name: "MAESTRO_ENV"
              value: "${ENVIRONMENT}"
          command:
            - /usr/local/bin/maestro
            - agent
            - --consumer-name=${CONSUMER_NAME}
            - --workload-source-driver=${MESSAGE_DRIVER_TYPE}
            - --workload-source-config=/secrets/${MESSAGE_DRIVER_TYPE}/config.yaml
            - --cloudevents-client-id=${CONSUMER_NAME}-work-agent
            - --appliedmanifestwork-eviction-grace-period=30s
            - -v=${KLOG_V}
          volumeMounts:
          - name: ${MESSAGE_DRIVER_TYPE}
            mountPath: /secrets/${MESSAGE_DRIVER_TYPE}
          - name: mqtt-certs
            mountPath: /secrets/mqtt-certs
          - name: grpc-broker-cert
            mountPath: /secretes/grpc-broker-certs
        volumes:
        - name: ${MESSAGE_DRIVER_TYPE}
          secret:
            secretName: maestro-agent-${MESSAGE_DRIVER_TYPE}
        - name: mqtt-certs
          secret:
            secretName: maestro-agent-certs
        - name: grpc-broker-cert
          secret:
            secretName: maestro-grpc-broker-cert

- apiVersion: v1
  kind: Secret
  metadata:
    name: maestro-agent-grpc
  stringData:
    config.yaml: |
      url: maestro-grpc-broker.maestro.svc:8091
      caFile: /secretes/grpc-broker-certs/ca.crt
      clientCertFile: /secretes/grpc-broker-certs/client.crt
      clientKeyFile: /secretes/grpc-broker-certs/client.key

- apiVersion: v1
  kind: Secret
  metadata:
    name: maestro-agent-mqtt
  stringData:
    config.yaml: |
      brokerHost: ${MQTT_HOST}:${MQTT_PORT}
      username: ${MQTT_USER}
      password: ${MQTT_PASSWORD}
      caFile: ${MQTT_ROOT_CERT}
      clientCertFile: ${MQTT_CLENT_CERT}
      clientKeyFile: ${MQTT_CLENT_KEY}
      topics:
        sourceEvents: sources/maestro/consumers/${CONSUMER_NAME}/sourceevents
        agentEvents: sources/maestro/consumers/${CONSUMER_NAME}/agentevents

- kind: ServiceAccount
  apiVersion: v1
  metadata:
    name: maestro-agent-sa
    labels:
      app: maestro-agent