demo.terraform

resource "kubernetes_namespace" "this" {
  metadata {
    labels {
      "istio-injection" = "enabled"
    }
    annotations {
      "iam.amazonaws.com/allowed-roles" = <<EOF
[".*"]
EOF
    }

    name = "bug-demo"
  }
}

resource "kubernetes_role_binding" "this" {
    metadata {
        name = "developer-role-binding"
        namespace = "bug-demo"
    }
    role_ref {
        api_group = "rbac.authorization.k8s.io"
        kind = "ClusterRole"
        name = "developer"
    }
    subject {
        kind = "Group"
        name = "developers"
        api_group = "rbac.authorization.k8s.io"
    }
}

# Tiller for this namespace. This restricts tiller to only be able to deploy to this namespace
resource "kubernetes_service_account" "this" {
  metadata {
    name = "tiller"
    namespace = "bug-demo"
  }
}

resource "kubernetes_role_binding" "tiller" {
    metadata {
        name = "tiller"
        namespace = "bug-demo"
    }
    role_ref {
        api_group = "rbac.authorization.k8s.io"
        kind = "ClusterRole"
        name = "tiller"
    }
    subject {
        kind = "ServiceAccount"
        name = "tiller"
        api_group = ""
    }
}

resource "kubernetes_deployment" "this" {
  metadata {
    name      = "tiller-deploy"
    namespace = "bug-demo"

    labels {
      "app.kubernetes.io/name"       = "helm"
      "app.kubernetes.io/component"  = "tiller"
      "app.kubernetes.io/managed-by" = "terraform"
      "app.kubernetes.io/version"    = "2.12.3"
    }

    annotations {
      "field.cattle.io/description" = "Helm Package Manager: required server-side component"
    }
  }

  spec {
    replicas = 1
    strategy = {}

    selector {
      match_labels {
        "app.kubernetes.io/name"      = "helm"
        "app.kubernetes.io/component" = "tiller"
      }
    }

    template {
      metadata {
        labels {
          "app.kubernetes.io/name"      = "helm"
          "app.kubernetes.io/component" = "tiller"
        }
      }

      spec {
        service_account_name = "tiller"

        container {
          env {
            name  = "TILLER_NAMESPACE"
            value = "bug-demo"
          }

          env {
            name  = "TILLER_HISTORY_MAX"
            value = "10"
          }

          image = "gcr.io/kubernetes-helm/tiller:v2.12.3"

          liveness_probe {
            http_get {
              path = "/liveness"
              port = 44135
            }

            initial_delay_seconds = 1
            timeout_seconds       = 1
          }

          name = "tiller"

          port {
            container_port = 44134
            name           = "tiller"
          }

          port {
            container_port = "44135"
            name           = "http"
          }

          readiness_probe {
            http_get {
              path = "/readiness"
              port = 44135
            }

            initial_delay_seconds = 1
            timeout_seconds       = 1
          }

          resources {}
        }
      }
    }
  }
}

resource "kubernetes_service" "this" {
  metadata {
    labels {
      "app.kubernetes.io/name"       = "helm"
      "app.kubernetes.io/component"  = "tiller"
      "app.kubernetes.io/managed-by" = "terraform"
    }

    annotations {
      "field.cattle.io/description" = "Helm Package Manager: required server-side component"
    }

    name      = "tiller-deploy"
    namespace = "bug-demo"
  }

  spec {
    port {
      name        = "tiller"
      port        = 44134
      target_port = "tiller"
    }

    selector {
      app  = "helm"
      name = "tiller"
    }

    type = "ClusterIP"
  }
}