apiVersion: addon.open-cluster-management.io/v1alpha1
kind: AddOnTemplate
metadata:
  labels:
    backplaneconfig.name: multiclusterengine
  name: managed-serviceaccount-2.10
spec:
  addonName: managed-serviceaccount
  agentSpec:
    workload:
      manifests:
      - apiVersion: v1
        kind: Namespace
        metadata:
          annotations:
            addon.open-cluster-management.io/deletion-orphan: ""
          labels:
            addon.open-cluster-management.io/namespace: "true"
          name: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          name: open-cluster-management:managed-serviceaccount:addon-agent
        rules:
        - apiGroups:
          - authentication.k8s.io
          resources:
          - tokenreviews
          verbs:
          - create
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRoleBinding
        metadata:
          name: open-cluster-management:managed-serviceaccount:addon-agent{{INSTALL_NAMESPACE}}
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:managed-serviceaccount:addon-agent
        subjects:
        - kind: ServiceAccount
          name: managed-serviceaccount
          namespace: open-cluster-management-agent-addon
      - apiVersion: v1
        kind: ConfigMap
        metadata:
          name: spoke-kubeconfig
          namespace: open-cluster-management-agent-addon
        data:
          kubeconfig: |
            apiVersion: v1
            kind: Config
            clusters:
            - cluster:
                certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZ6akNDQTdhZ0F3SUJBZ0lVWkN1aTRTakU5cXJady9mcU95S0cvaWhvYzFRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZTXhDekFKQmdOVkJBWVRBbFZUTVJNd0VRWURWUVFJREFwRFlXeHBabTl5Ym1saE1SWXdGQVlEVlFRSApEQTFUWVc0Z1JuSmhibU5wYzJOdk1SVXdFd1lEVlFRS0RBeE5lVVZ1ZEdWeWNISnBjMlV4Q3pBSkJnTlZCQXNNCkFrbFVNU013SVFZRFZRUUREQnBGYm5SbGNuQnlhWE5sSUVsdWRHVnliV1ZrYVdGMFpTQkRRVEFlRncweU5URXkKTVRBeU16STBORFphRncweU5qRXlNVEF5TXpJME5EWmFNSGN4Q3pBSkJnTlZCQVlUQWxWVE1STXdFUVlEVlFRSQpEQXBEWVd4cFptOXlibWxoTVJZd0ZBWURWUVFIREExVFlXNGdSbkpoYm1OcGMyTnZNUlV3RXdZRFZRUUtEQXhOCmVVVnVkR1Z5Y0hKcGMyVXhDekFKQmdOVkJBc01Ba2xVTVJjd0ZRWURWUVFEREE1cmRXSmxMV0Z3YVhObGNuWmwKY2pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBUGZyMnM5dmtJRjZMOVpJYkdaZQo4WndBdUV3Qm1saXYxcjhWNlN0WTFhTXR3aUlycTQyU2VlcEJVOWxLRlRXVnVJUHUwU3ZMUFRlenRqcTc3dEZQCkMzd01PYmd1UVJvdGhLY0lwb213UU4wS05zTFRDdFl4MEtBRlpWNnFNVThjL04rVE1iaE5aZ2lpUlc5ME5haVQKanhuZzdya1MrbzFZd1pHb0pjaERDQXlXM2dpSVlqTXdnSllOcytmSVRCdVFza0Y4YUtHR0xMNklLelora3BhOAp0RjBXa1JwbGR5OG5BSU5mVDUyb3AzZU9kWXFSbENSSWxLVGVuS1Y3Y2VOQ3kvWmxMRmxIYU8xNUR5b1NGR05PCnZNMGNjV0RlRGNJbm9wWVhqNys2RHJLdUh1Sk4xOHc3SW5RSGpTZE5FUnZ1bUJVYkx5L2dhUTZjaWUxZVREU3gKeFNzQ0F3RUFBYU9DQVVNd2dnRS9NQjhHQTFVZEl3UVlNQmFBRk9YTjF5RTgwS2RtY0dBZzgxQkFsUVNMNEczZgpNQWtHQTFVZEV3UUNNQUF3RGdZRFZSMFBBUUgvQkFRREFnV2dNQk1HQTFVZEpRUU1NQW9HQ0NzR0FRVUZCd01CCk1JSE1CZ05WSFJFRWdjUXdnY0dDQ210MVltVnlibVYwWlhPQ0VtdDFZbVZ5Ym1WMFpYTXVaR1ZtWVhWc2RJSVcKYTNWaVpYSnVaWFJsY3k1a1pXWmhkV3gwTG5OMlk0SWthM1ZpWlhKdVpYUmxjeTVrWldaaGRXeDBMbk4yWXk1agpiSFZ6ZEdWeUxteHZZMkZzZ2o1aGNHa3VZWEJ3TFdGM2N5MWxZWE4wTWkwME1Ua3RjMjV2TFRKNGJDMTZiVzVqCmR5NWtaWFl4TVM1eVpXUXRZMmhsYzNSbGNtWnBaV3hrTG1OdmJZSUpiRzlqWVd4b2IzTjBod1FTdkNFRGh3Ui8KQUFBQmh3U3NIZ0FCaHdRS0FBQndNQjBHQTFVZERnUVdCQlEzR09NN295OUVISVB1VGdTQVFhUHhBam9GSGpBTgpCZ2txaGtpRzl3MEJBUXNGQUFPQ0FnRUFaY2FXZ0Ixc0tneityaU9ROGlMZ08xVjRsYXp5WTNVcnhhMU1kWXRCCnFPMHQzckEwbHpZUVFFWFR3RkswK1cvK1FYT0RIU0JDazV5ZzlkR1pBVFdnalZGUWlScTJkS1QrYUhQSXVwR3YKWk56QjMvRDFVZDloOTBIYmM2N09pN0hPeEI3Zll5TVorUW8wK1hLSkg4MTZncW5PTWNKeWhFU3RYTDFyYlpQTgp0MFdiUGx1NXBCU2lDcldxa2JHQXhZbjZGc0VDTlJVaTMvV2RsVmlyUzNyQy9OTWFYVUd5OG5HMjBGQ2ZuVHFQCjl5RWphdW5UczJkMHczU1NEb24rWHlTcE44RnI2dzVMejl6c3JHUll4b1lEbmEyWXFGRzVhRTZGR2VmcWRLR28KMDZnTUx5VUhKWVB3U2QwVG5JT1NOU1RVUlZ3ZnBiWTk4U1FUYmVmTklRc2pRM1BwSmlCUG1ONCswV0ZBM2dwNQpQcHFmdGp0UFc3RlpIU2d5RTloRm1NanNBTWNXNjVJR1ZtNjQ5Z1Q3SXR2TVpSd3pJRjIwRWlGUEhHS010WVFjCnNiYjNHbjNLS21VeHovQ2kyUGZ5NTE1eU9UWXl6aUdjNkIwSHFKNXZDUjE5YUR1cWNQTUFUVkFkNHZaeHVGSm8KUGszczR2dVdrVVFMOU1DZGh4MnlPc3VGVmh5THpSOHorbU1HMVFVZGxIQTFPd1crUDNLUVhCSzVQK2M2cVpENwpVQTF4N0ZYdnpDZENEanc4M3ZFTnlBaHg5ZGVRKzZqVFFsdmxGb2pWanZVQkNtMWdmWFhaNGlCTjhURmw1b1Y2CkMzTElrRkRHaEtWTG5PM2l6VnU5WnB1S3VUYkFSN281b21ta0xxWEF0bURUd1Ztd2VnbmlWOU5TemkxTWN4VEMKbWJVPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlGOHpDQ0E5dWdBd0lCQWdJVUlraEVTNmlIUWpXVFdtWXUxcVo3VmFWM09oNHdEUVlKS29aSWh2Y05BUUVMCkJRQXdlekVMTUFrR0ExVUVCaE1DVlZNeEV6QVJCZ05WQkFnTUNrTmhiR2xtYjNKdWFXRXhGakFVQmdOVkJBY00KRFZOaGJpQkdjbUZ1WTJselkyOHhGVEFUQmdOVkJBb01ERTE1Ulc1MFpYSndjbWx6WlRFTE1Ba0dBMVVFQ3d3QwpTVlF4R3pBWkJnTlZCQU1NRWtWdWRHVnljSEpwYzJVZ1VtOXZkQ0JEUVRBZUZ3MHlOVEV5TVRBeU1ETXpORE5hCkZ3MHpNREV5TURreU1ETXpORE5hTUlHRE1Rc3dDUVlEVlFRR0V3SlZVekVUTUJFR0ExVUVDQXdLUTJGc2FXWnYKY201cFlURVdNQlFHQTFVRUJ3d05VMkZ1SUVaeVlXNWphWE5qYnpFVk1CTUdBMVVFQ2d3TVRYbEZiblJsY25CeQphWE5sTVFzd0NRWURWUVFMREFKSlZERWpNQ0VHQTFVRUF3d2FSVzUwWlhKd2NtbHpaU0JKYm5SbGNtMWxaR2xoCmRHVWdRMEV3Z2dJaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQ0R3QXdnZ0lLQW9JQ0FRQ1YyM0VBZlJvVXdLbGcKN2pBNkl2N2ZmcDU0KzdXMWdqTG5GQkVPRVZBNlU5ZWFndS9kbGYzSENSYmhseTFzY1ZkSFFubHVON2piZFZkaApuNXh0Nnd6Rmo1aENSU041TVNudkJYN044YWtjam1jeE5na0pCSEhITVVENlQ1eTNDdGw4aFJPNHJiYW50b0RECjlmbzl1bVZON2lEWTIwRG9LY09QMkZHcVh0azNiSUNKcDVzb3RrQUNURU1BWSs3N040ZmRsSTZ0OXhReDVWV2QKeXBZZXl2RWIzbUtNemlRTS95MU9yaS9lUXgreUJpbWlZUnF3OWNESHBrcGlULytZUUh2Zmd6djhURG9nK2haZwpRZitDcFk5aHpMT3hWbEtXVlZHa1J0cFdYZ1E2MDROeGtHSWpmNzZLaW4zYWdpdG9XSUxQeHY3WWhOT2RwS3BvClQ5WmZTYjgveTFzLy9OK2VHVkIzQ1N4Q1VjOFlMMW5CN01jdVlPVU5XUEpPSlZZWG9XNmlJeFJZVkdCVXY2L0sKNUh0Unp6eFNoa1VrK2g5NDdtcDQranBKMUZjRFNnWXR4S0ozbitMZWF5dTE5NnpocStodXRSa0J0blpFS3FKdworaFo3enlURTkxR2Rudmw5cTJkdUttc0dlanpKNlVCSklUNm5Gb2ZVOURVM2pWUXpGblgwcklsNllmV2h3aFBnCkpLWFkvRVhxaG1HK3ZiZTh6c05sUUF3MFRJZlRJTXdiUE1RbC9Qay9od0JiQUduRWdrc3dWSk0wVTVCWU8rdkYKV3hLWVU5bENhZ0xDdkRqRnlHNFFSZ3VSdzQvWVdIVlNra0ErUE0vTi9QNE5yTDRDQjdNOTl1aGdWS2trS1VsTwo5SDAvbUlGb1U1cy9mVmxEVnpJMHB2dVlueDQ3elFJREFRQUJvMll3WkRBZkJnTlZIU01FR0RBV2dCUVRvdDBYCjRZUGtDaUViS2x2bEVIY0p6OXhIM1RBU0JnTlZIUk1CQWY4RUNEQUdBUUgvQWdFQU1BNEdBMVVkRHdFQi93UUUKQXdJQmhqQWRCZ05WSFE0RUZnUVU1YzNYSVR6UXAyWndZQ0R6VUVDVkJJdmdiZDh3RFFZSktvWklodmNOQVFFTApCUUFEZ2dJQkFHeHlBeTl6RDZDdjFINE1FUEVTalhXVXVLY3d5RFZyZDVWTFMxb3lkMjVIcFk5NUlDek1VYVVjClVKNjh0endDdzBWZWNGRDAwa2xnQjJNa0NiUVNVdHZHUUxqYU1wbHh3dXBocUQwZGp3M2VNSXg5TDROVjR5SHAKVVlYT25jRUk5aGdCYThkZHZvN3p6bUJTQ3dsY3IyUm5JUExSWFhmeWR5TkgyZUpGQVZtRGpsNFc5bGkrc3UzaworTGY1ZWRTY0kxNVBjZG0vcFRHd0hveHF5Q2hscXl2dzBWNzR1cnQ2V2RVc0xvYWQ5dG9SazArNFVNcXFsRHpGCnoxMVBrNldjYTVrMWwveUdDay93ZFVpMGZqWnc5TEZqMXRaZVVHMmN1UGZ6SUhHYUFFZmdsU09WVU80RGxFUlQKd3d3N05NamRDcHhKTXZXN1krZHlWQUpYYmd2aXdFME5oL040WUFVM2VvbWlPSWpxb3VUQ1kzVEsvNWoxKzh5cgpucWNZWFB6bkV1OUhZMVJIQk1udnJFcERHTS9GQUJ2TkkwMzZiQVRualpCTk5IM01CeHFSeXRIeE1Xb0FDRlE3ClNBaExlVk8zeWs3L0wzYW4yVm9QMmt4WFMzZzM3K3NlbGtaUGNaSG9JckF6WTNMRjVHWG1OR01CT3FDTDZlbGEKVWRCNmJKdmhGQmFrTmd1MVl4NkxYUzJYVjNVdDM0dHRmMUtMRnRsYVNMTnJ1dVZsVUFTd1FhT1M0M0x3L3I3dApsb1RURURsZmpyTllFQnplcVJUanN1TVlTclVyU1VhTnVNbGhOUjlCSit4TUVxUXpjTlcrekwvRkpWdUxQdUs3CnY3RGFsb3pwOGg3SnNLWnV2bnM5WnBsUGpXL3l5QmkrZGVWdHRIOFJrRXl0b0pDWmFsSWMKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQotLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KTUlJRjF6Q0NBNytnQXdJQkFnSVVCajFDdkM0ak1VNXIyMnl6R01Sa2tTYm1iVUV3RFFZSktvWklodmNOQVFFTApCUUF3ZXpFTE1Ba0dBMVVFQmhNQ1ZWTXhFekFSQmdOVkJBZ01Da05oYkdsbWIzSnVhV0V4RmpBVUJnTlZCQWNNCkRWTmhiaUJHY21GdVkybHpZMjh4RlRBVEJnTlZCQW9NREUxNVJXNTBaWEp3Y21selpURUxNQWtHQTFVRUN3d0MKU1ZReEd6QVpCZ05WQkFNTUVrVnVkR1Z5Y0hKcGMyVWdVbTl2ZENCRFFUQWVGdzB5TlRFeU1UQXlNRE15TURaYQpGdzB6TlRFeU1EZ3lNRE15TURaYU1Ic3hDekFKQmdOVkJBWVRBbFZUTVJNd0VRWURWUVFJREFwRFlXeHBabTl5CmJtbGhNUll3RkFZRFZRUUhEQTFUWVc0Z1JuSmhibU5wYzJOdk1SVXdFd1lEVlFRS0RBeE5lVVZ1ZEdWeWNISnAKYzJVeEN6QUpCZ05WQkFzTUFrbFVNUnN3R1FZRFZRUUREQkpGYm5SbGNuQnlhWE5sSUZKdmIzUWdRMEV3Z2dJaQpNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUNEd0F3Z2dJS0FvSUNBUURaV2N0dHoyL3pZUi9iNzF4cHZra3k1dHArCm5aSy9aaU43dS9kVnoyUzdmNE9OaVRRelZBWWZTMHI1ZTR1aFRPZGhaWFJMazBYT0VPNnNUcG9Tdmx1Y3hNMEkKTy9UckRmcHU2czM5aEFYMUhiL3ZocmtsZllYcVJrTG52Yy8rSDdrY296cU5pREpqaWtXZ0JuUS9xRi8rY0RsNgpaZjFQcXYrdWltaUhldStiaHlxRkVxV3djQW1VQnJVNGRvQ091WWlKOGdMRWdhMHpoRG5UU3dYYS8xMWJma1haCktCblF2VS9HNDFuTEE1R1RnTlhodUh5cHFtZ29LYW9EN2hvSWppM0RYZUI0OWEwZ2dzUkVreDN2ZnppQ0FqOVQKbkJSZ3BKOFVDYnRIQ2NZZWNLN2k0UGJkZzQrNTc1WitpMC9rT2VOdFNnSWgyYXh0VnljS0JSMndPQzFacDVqTQpHbm1OVllhMXZGWGc2Szk5VHBReFFKR2Zwc1d5NTlzZVo2Qy9PS3RXVmF4anRwdEd2cG5NYk1wUk5qNjJQWVoxCnpTNks0MHI2MDFacUFGbCsrK1hwTDE0ODJwam5EQ1ZqT2VPbkNWS0czZ0dWbXdKODBNOG1FTGRsbWhBZmRJN1cKSk1CQW5RbmFxSUM2bXlCV0drSW1iT2t2V3kwTWFtbGJCeWltcWFUN09UeURTZ3g4Y1VlYzdkbFdoWGxUdm04RApVL2ovdHBHZVpLMmhobk5HTGV4WHJvTi90d1Fjak0wNnhoL2NUd3A0V1crdDRkZmFzbXBqUWZWNlRMZ1R1T0lxCndad0lLZU5zakx2ejZWVFNIZU1PRUh3TWlKQnp3MmlEVEYvSk5mdlBmVUpMdkRSWHY2WHlTczlxbmgrM1pQQVoKeDRvYjJiRGhFMDU1d1FwOVZRSURBUUFCbzFNd1VUQWRCZ05WSFE0RUZnUVVFNkxkRitHRDVBb2hHeXBiNVJCMwpDYy9jUjkwd0h3WURWUjBqQkJnd0ZvQVVFNkxkRitHRDVBb2hHeXBiNVJCM0NjL2NSOTB3RHdZRFZSMFRBUUgvCkJBVXdBd0VCL3pBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQWdFQVJjOXRRSUhEUWo5QVRvR2ZYZURKcCtoZ29rQXgKSkl5REhSL2FpeXhYSi9vQm9QeXhvMmlidTJCZzA4U1JlNlVZTEZHV3pKVTRtWEk0OU5FRERFeHhhYU5Dd2xPbQo5T3BHdXl3Wmx5VDBOM2swSDhxMHNNL2xwSWwzVFh0K0M1MXByWU16cExZdUhBK3U4WncyNFRCVTBmZHlLcmR6Cisxc3UzdVBja3ZLdlJwWVMyeHhEYWV1T3psb1BpTFU2NXZXbjNOM0Z2SEE5c3QyZytxUklUMWdMRmpSdkRvcDgKWnlWcHh5ZklmdGFvcEhkc0ZraVE3cXloZExMTWpHbXZaeGFlR291SkhrVnRnNi9WOUJlODMzK0F0UHErUEZEWgpLR21WeW8rSWJVYUI5QjNGeXJWbnBrL2d1QlZXSG1wZC8wcmNMNitGano4OXR3TDJ2NGpmNERsT0ttbys0T21jCm44RE95TERteE9QZTJ6YU43WkZYSkJlZmxuRHNORmw5YzRwTXBhT21mSU1kZVNWNldMcVRMTG9JNHZtQnpwRm8KbXJlUTQ1Mk45RFA2SEI4dG02KzdjK1IvSEtVU1JNMEcydE1CMlFlS2tUcllhVExjM0Uya3hzTlVjYTFVOWpBdAp0N3RtYjhUV3ErZ0YzS3lidWtMdHo0STNDTHJBeDR6Q2JReVZFcmJvN2krNjQrU1VoT3lmckN6VVFyV21JbEFqClViSENXRWpjNkFxWWN4TDZpb3pIOFVyKzVYNG14cEtYcnN3aHdPeFNwZnZDUTd5M1pSTTg3eGtDekJLQmlhNWIKaVBZUTJtNmQraFVETGxraVY2R1J1T205VW5WMnl6cldtREx0Z3B6a256QUxKam8zOWdZaXlocUpkamJYKzlKcQp4YzQ3M1pWMGpEcU93ek09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
                server: https://api.app-aws-east2-419-sno-2xl-zmncw.dev11.red-chesterfield.com:6443
              name: spoke
            contexts:
            - context:
                cluster: spoke
                user: spoke-user
              name: spoke
            current-context: spoke
            users:
            - name: spoke-user
              user:
                tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      - apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: managed-serviceaccount-addon-agent
          namespace: open-cluster-management-agent-addon
        spec:
          replicas: 1
          selector:
            matchLabels:
              addon-agent: managed-serviceaccount
          template:
            metadata:
              annotations:
                target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
              labels:
                addon-agent: managed-serviceaccount
            spec:
              containers:
              - args:
                - --cluster-name={{CLUSTER_NAME}}
                - --kubeconfig={{HUB_KUBECONFIG}}
                - --spoke-kubeconfig=/etc/spoke/kubeconfig
                - --feature-gates=EphemeralIdentity=true
                command:
                - /msa
                - agent
                image: quay.io/stolostron/managed-serviceaccount@sha256:380509aa0256e8b33de178046972737f2073013fdc82af826b094861e9766a52
                imagePullPolicy: IfNotPresent
                livenessProbe:
                  httpGet:
                    path: /healthz
                    port: 8000
                  initialDelaySeconds: 2
                  periodSeconds: 10
                name: addon-agent
                volumeMounts:
                  - name: spoke-kubeconfig
                    mountPath: /etc/spoke
                    readOnly: true
              serviceAccount: managed-serviceaccount
              volumes:
                - name: spoke-kubeconfig
                  configMap:
                    name: spoke-kubeconfig
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
          name: open-cluster-management:managed-serviceaccount:addon-agent
          namespace: open-cluster-management-agent-addon
        rules:
        - apiGroups:
          - ""
          resources:
          - events
          verbs:
          - create
        - apiGroups:
          - ""
          resources:
          - serviceaccounts
          - serviceaccounts/token
          verbs:
          - get
          - watch
          - list
          - create
          - delete
        - apiGroups:
          - coordination.k8s.io
          resources:
          - leases
          verbs:
          - get
          - create
          - update
          - patch
        - apiGroups:
          - authentication.k8s.io
          resources:
          - tokenrequests
          verbs:
          - get
          - create
          - update
          - patch
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: RoleBinding
        metadata:
          name: open-cluster-management:managed-serviceaccount:addon-agent
          namespace: open-cluster-management-agent-addon
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: Role
          name: open-cluster-management:managed-serviceaccount:addon-agent
        subjects:
        - kind: ServiceAccount
          name: managed-serviceaccount
          namespace: open-cluster-management-agent-addon
      - apiVersion: v1
        imagePullSecrets:
        - name: open-cluster-management-image-pull-credentials
        kind: ServiceAccount
        metadata:
          name: managed-serviceaccount
          namespace: open-cluster-management-agent-addon
  registration:
  - kubeClient:
      hubPermissions:
      - currentCluster:
          clusterRoleName: managed-serviceaccount-addon-agent
        type: CurrentCluster
    type: KubeClient
