---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    cluster.x-k8s.io/provider: cluster-api
    clusterctl.cluster.x-k8s.io: ""
  name: capi-admin-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: capi-manager
  namespace: capi-system

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: cluster-api
    clusterctl.cluster.x-k8s.io: ""
  name: capi-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: capi-aggregated-manager-role
subjects:
  - kind: ServiceAccount
    name: capi-manager
    namespace: capi-system

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    cluster.x-k8s.io/aggregate-to-manager: "true"
    cluster.x-k8s.io/provider: cluster-api
    clusterctl.cluster.x-k8s.io: ""
  name: capi-manager-role
rules:
  - apiGroups:
      - ""
    resources:
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - addons.cluster.x-k8s.io
    resources:
      - "*"
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - addons.cluster.x-k8s.io
    resources:
      - clusterresourcesets/finalizers
      - clusterresourcesets/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
    verbs:
      - create
  - apiGroups:
      - authorization.k8s.io
    resources:
      - subjectaccessreviews
    verbs:
      - create
  - apiGroups:
      - bootstrap.cluster.x-k8s.io
      - controlplane.cluster.x-k8s.io
      - infrastructure.cluster.x-k8s.io
    resources:
      - "*"
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - bootstrap.cluster.x-k8s.io
      - infrastructure.cluster.x-k8s.io
    resources:
      - "*"
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - clusterclasses
    verbs:
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - clusterclasses
      - clusterclasses/status
    verbs:
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - clusters
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - clusters
      - clusters/finalizers
      - clusters/status
    verbs:
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - clusters
      - clusters/status
    verbs:
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinedeployments
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinedeployments
      - machinedeployments/finalizers
    verbs:
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinedeployments
      - machinedeployments/finalizers
      - machinedeployments/status
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinehealthchecks
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinehealthchecks
      - machinehealthchecks/finalizers
      - machinehealthchecks/status
    verbs:
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinepools
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinepools
      - machinepools/finalizers
      - machinepools/status
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machines
      - machines/finalizers
      - machines/status
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machines
      - machines/status
    verbs:
      - delete
      - get
      - list
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinesets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinesets
      - machinesets/finalizers
    verbs:
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinesets
      - machinesets/finalizers
      - machinesets/status
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - ipam.cluster.x-k8s.io
    resources:
      - ipaddressclaims
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - runtime.cluster.x-k8s.io
    resources:
      - extensionconfigs
      - extensionconfigs/status
    verbs:
      - get
      - list
      - patch
      - update
      - watch

---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    cluster.x-k8s.io/provider: cluster-api
    clusterctl.cluster.x-k8s.io: ""
  name: capi-manager
  namespace: capi-system

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    cluster.x-k8s.io/provider: cluster-api
    clusterctl.cluster.x-k8s.io: ""
  name: capi-leader-election-role
  namespace: capi-system
rules:
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: cluster-api
    clusterctl.cluster.x-k8s.io: ""
  name: capi-leader-election-rolebinding
  namespace: capi-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: capi-leader-election-role
subjects:
  - kind: ServiceAccount
    name: capi-manager
    namespace: capi-system

---
aggregationRule:
  clusterRoleSelectors:
    - matchLabels:
        cluster.x-k8s.io/aggregate-to-manager: "true"
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    cluster.x-k8s.io/provider: cluster-api
    clusterctl.cluster.x-k8s.io: ""
  name: capi-aggregated-manager-role
rules: []

---
apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: cluster-api
    clusterctl.cluster.x-k8s.io: ""
    control-plane: controller-manager
  name: capi-controller-manager
  namespace: capi-system
spec:
  replicas: 1
  selector:
    matchLabels:
      cluster.x-k8s.io/provider: cluster-api
      control-plane: controller-manager
  strategy: {}
  template:
    metadata:
      labels:
        cluster.x-k8s.io/provider: cluster-api
        control-plane: controller-manager
    spec:
      containers:
        - args:
            - --leader-elect
            - --diagnostics-address=:8443
            - --insecure-diagnostics=false
            - --use-deprecated-infra-machine-naming=false
            - --feature-gates=MachinePool=true,ClusterResourceSet=true,ClusterTopology=false,RuntimeSDK=false,MachineSetPreflightChecks=false
          command:
            - /manager
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_UID
              valueFrom:
                fieldRef:
                  fieldPath: metadata.uid
          image: registry.k8s.io/cluster-api/cluster-api-controller:v1.8.5
          imagePullPolicy: Always
          livenessProbe:
            httpGet:
              path: /healthz
              port: healthz
          name: manager
          ports:
            - containerPort: 9443
              name: webhook-server
              protocol: TCP
            - containerPort: 9440
              name: healthz
              protocol: TCP
            - containerPort: 8443
              name: metrics
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /readyz
              port: healthz
          resources:
            requests:
              cpu: 10m
              memory: 50Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            privileged: false
            runAsGroup: 65532
            runAsUser: 65532
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
            - mountPath: /tmp/k8s-webhook-server/serving-certs
              name: cert
              readOnly: true
      priorityClassName: system-cluster-critical
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: capi-manager
      terminationGracePeriodSeconds: 10
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
        - effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
      volumes:
        - name: cert
          secret:
            secretName: capi-webhook-service-cert
status: {}

---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  annotations:
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: cluster-api
    clusterctl.cluster.x-k8s.io: ""
  name: capi-mutating-webhook-configuration
webhooks:
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /mutate-cluster-x-k8s-io-v1beta1-machine
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.machine.cluster.x-k8s.io
    rules:
      - apiGroups:
          - cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - machines
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /mutate-cluster-x-k8s-io-v1beta1-machinedeployment
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.machinedeployment.cluster.x-k8s.io
    rules:
      - apiGroups:
          - cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - machinedeployments
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /mutate-cluster-x-k8s-io-v1beta1-machinehealthcheck
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.machinehealthcheck.cluster.x-k8s.io
    rules:
      - apiGroups:
          - cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - machinehealthchecks
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /mutate-cluster-x-k8s-io-v1beta1-machineset
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.machineset.cluster.x-k8s.io
    rules:
      - apiGroups:
          - cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - machinesets
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /mutate-runtime-cluster-x-k8s-io-v1alpha1-extensionconfig
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.extensionconfig.runtime.addons.cluster.x-k8s.io
    rules:
      - apiGroups:
          - runtime.cluster.x-k8s.io
        apiVersions:
          - v1alpha1
        operations:
          - CREATE
          - UPDATE
        resources:
          - extensionconfigs
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /mutate-cluster-x-k8s-io-v1beta1-machinepool
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.machinepool.cluster.x-k8s.io
    rules:
      - apiGroups:
          - cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - machinepools
    sideEffects: None

---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  annotations:
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: cluster-api
    clusterctl.cluster.x-k8s.io: ""
  name: capi-validating-webhook-configuration
webhooks:
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /validate-cluster-x-k8s-io-v1beta1-machine
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.machine.cluster.x-k8s.io
    rules:
      - apiGroups:
          - cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - machines
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /validate-cluster-x-k8s-io-v1beta1-machinedeployment
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.machinedeployment.cluster.x-k8s.io
    rules:
      - apiGroups:
          - cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - machinedeployments
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /validate-cluster-x-k8s-io-v1beta1-machinehealthcheck
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.machinehealthcheck.cluster.x-k8s.io
    rules:
      - apiGroups:
          - cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - machinehealthchecks
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /validate-cluster-x-k8s-io-v1beta1-machineset
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.machineset.cluster.x-k8s.io
    rules:
      - apiGroups:
          - cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - machinesets
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /validate-runtime-cluster-x-k8s-io-v1alpha1-extensionconfig
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.extensionconfig.runtime.cluster.x-k8s.io
    rules:
      - apiGroups:
          - runtime.cluster.x-k8s.io
        apiVersions:
          - v1alpha1
        operations:
          - CREATE
          - UPDATE
        resources:
          - extensionconfigs
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /validate-cluster-x-k8s-io-v1beta1-machinepool
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.machinepool.cluster.x-k8s.io
    rules:
      - apiGroups:
          - cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - machinepools
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /validate-addons-cluster-x-k8s-io-v1beta1-clusterresourceset
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.clusterresourceset.addons.cluster.x-k8s.io
    rules:
      - apiGroups:
          - addons.cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - clusterresourcesets
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /validate-addons-cluster-x-k8s-io-v1beta1-clusterresourcesetbinding
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.clusterresourcesetbinding.addons.cluster.x-k8s.io
    rules:
      - apiGroups:
          - addons.cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - clusterresourcesetbindings
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /validate-ipam-cluster-x-k8s-io-v1beta1-ipaddress
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.ipaddress.ipam.cluster.x-k8s.io
    rules:
      - apiGroups:
          - ipam.cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
          - DELETE
        resources:
          - ipaddresses
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capi-webhook-service
        namespace: capi-system
        path: /validate-ipam-cluster-x-k8s-io-v1beta1-ipaddressclaim
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.ipaddressclaim.ipam.cluster.x-k8s.io
    rules:
      - apiGroups:
          - ipam.cluster.x-k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
          - DELETE
        resources:
          - ipaddressclaims
    sideEffects: None

---
apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.openshift.io/serving-cert-secret-name: capi-webhook-service-cert
  labels:
    cluster.x-k8s.io/provider: cluster-api
    clusterctl.cluster.x-k8s.io: ""
  name: capi-webhook-service
  namespace: capi-system
spec:
  ports:
    - port: 443
      targetPort: webhook-server
  selector:
    cluster.x-k8s.io/provider: cluster-api

#---
#apiVersion: admissionregistration.k8s.io/v1beta1
#kind: ValidatingAdmissionPolicy
#metadata:
#  name: capi-system-protect-cluster-apicluster
#spec:
#  failurePolicy: Fail
#  matchConstraints:
#    resourceRules:
#      - apiGroups:
#          - infrastructure.cluster.x-k8s.io
#        apiVersions:
#          - "*"
#        operations:
#          - DELETE
#        resources:
#          - cluster-apiclusters
#  paramKind:
#    apiVersion: config.openshift.io/v1
#    kind: Infrastructure
#  validations:
#    - expression: "!(oldObject.metadata.name == params.status.infrastructureName)"
#      message: InfraCluster resources with metadata.name corresponding to the cluster
#        infrastructureName cannot be deleted.

#---
#apiVersion: admissionregistration.k8s.io/v1beta1
#kind: ValidatingAdmissionPolicyBinding
#metadata:
#  name: cluster-api-protect-cluster-apicluster
#spec:
#  matchResources:
#    namespaceSelector:
#      matchLabels:
#        kubernetes.io/metadata.name: cluster-api
#  paramRef:
#    name: cluster
#    parameterNotFoundAction: Deny
#  policyName: cluster-api-protect-cluster-apicluster
#  validationActions:
#    - Deny

