# Caddy Ingress Controller for kind
# Based on: https://github.com/caddyserver/ingress
# Provides automatic HTTPS with Let's Encrypt
apiVersion: v1
kind: Namespace
metadata:
  name: caddy-system
  labels:
    app.kubernetes.io/name: caddy-ingress-controller
    app.kubernetes.io/instance: caddy-ingress
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: caddy-ingress-controller
  namespace: caddy-system
  labels:
    app.kubernetes.io/name: caddy-ingress-controller
    app.kubernetes.io/instance: caddy-ingress
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: caddy-ingress-controller
  labels:
    app.kubernetes.io/name: caddy-ingress-controller
    app.kubernetes.io/instance: caddy-ingress
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - endpoints
      - nodes
      - pods
      - namespaces
      - services
    verbs:
      - list
      - watch
      - get
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - list
      - watch
      - get
      - create
      - update
      - delete
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - get
      - create
      - update
      - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: caddy-ingress-controller
  labels:
    app.kubernetes.io/name: caddy-ingress-controller
    app.kubernetes.io/instance: caddy-ingress
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: caddy-ingress-controller
subjects:
  - kind: ServiceAccount
    name: caddy-ingress-controller
    namespace: caddy-system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: caddy-ingress-controller-configmap
  namespace: caddy-system
  labels:
    app.kubernetes.io/name: caddy-ingress-controller
    app.kubernetes.io/instance: caddy-ingress
data:
  # Caddy global options
  acmeCA: "https://acme-v02.api.letsencrypt.org/directory"
  email: ""
---
apiVersion: v1
kind: Service
metadata:
  name: caddy-ingress-controller
  namespace: caddy-system
  labels:
    app.kubernetes.io/name: caddy-ingress-controller
    app.kubernetes.io/instance: caddy-ingress
    app.kubernetes.io/component: controller
spec:
  type: NodePort
  ports:
    - name: http
      port: 80
      targetPort: http
      protocol: TCP
    - name: https
      port: 443
      targetPort: https
      protocol: TCP
  selector:
    app.kubernetes.io/name: caddy-ingress-controller
    app.kubernetes.io/instance: caddy-ingress
    app.kubernetes.io/component: controller
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: caddy-ingress-controller
  namespace: caddy-system
  labels:
    app.kubernetes.io/name: caddy-ingress-controller
    app.kubernetes.io/instance: caddy-ingress
    app.kubernetes.io/component: controller
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: caddy-ingress-controller
      app.kubernetes.io/instance: caddy-ingress
      app.kubernetes.io/component: controller
  template:
    metadata:
      labels:
        app.kubernetes.io/name: caddy-ingress-controller
        app.kubernetes.io/instance: caddy-ingress
        app.kubernetes.io/component: controller
    spec:
      serviceAccountName: caddy-ingress-controller
      terminationGracePeriodSeconds: 60
      nodeSelector:
        ingress-ready: "true"
        kubernetes.io/os: linux
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Equal
        - effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
          operator: Equal
      containers:
        - name: caddy-ingress-controller
          image: caddy/ingress:latest
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 80
              hostPort: 80
              protocol: TCP
            - name: https
              containerPort: 443
              hostPort: 443
              protocol: TCP
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          args:
            - -config-map=caddy-system/caddy-ingress-controller-configmap
            - -class-name=caddy
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 1000m
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /healthz
              port: 9765
            initialDelaySeconds: 3
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: 9765
            initialDelaySeconds: 3
            periodSeconds: 10
          securityContext:
            allowPrivilegeEscalation: true
            capabilities:
              add:
                - NET_BIND_SERVICE
              drop:
                - ALL
            runAsUser: 0
            runAsGroup: 0
          volumeMounts:
            - name: caddy-data
              mountPath: /data
            - name: caddy-config
              mountPath: /config
      volumes:
        - name: caddy-data
          emptyDir: {}
        - name: caddy-config
          emptyDir: {}
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: caddy
  labels:
    app.kubernetes.io/name: caddy-ingress-controller
    app.kubernetes.io/instance: caddy-ingress
  annotations:
    ingressclass.kubernetes.io/is-default-class: "true"
spec:
  controller: caddy.io/ingress-controller
