---
# Source: terraform/templates/sync-workspace-serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: terraform-terraform-sync-workspace
  labels:
    app: terraform
    chart: terraform-helm
    heritage: Helm
    release: terraform
---
# Source: terraform/templates/sync-workspace-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: terraform-terraform-sync-workspace
  labels:
    app: terraform
    chart: terraform-helm
    heritage: Helm
    release: terraform
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - services
  - services/finalizers
  - endpoints
  - persistentvolumeclaims
  - events
  - configmaps
  - secrets
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - configmaps/status
  verbs:
  - get
  - update
  - patch
- apiGroups:
  - apps
  resources:
  - deployments
  - daemonsets
  - replicasets
  - statefulsets
  verbs:
  - '*'
- apiGroups:
  - monitoring.coreos.com
  resources:
  - servicemonitors
  verbs:
  - get
  - create
- apiGroups:
  - apps
  resourceNames:
  - terraform-k8s
  resources:
  - deployments/finalizers
  verbs:
  - update
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
- apiGroups:
  - apps
  resources:
  - replicasets
  verbs:
  - get
- apiGroups:
  - app.terraform.io
  resources:
  - '*'
  - workspaces
  verbs:
  - '*'
- apiGroups:
    - coordination.k8s.io
  resources:
    - leases
  verbs:
    - create
    - get
    - update
---
# Source: terraform/templates/sync-workspace-rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: terraform-terraform-sync-workspace
  labels:
    app: terraform
    chart: terraform-helm
    heritage: Helm
    release: terraform
subjects:
- kind: ServiceAccount
  name: terraform-terraform-sync-workspace
  namespace: default
roleRef:
  kind: Role
  name: terraform-terraform-sync-workspace
  apiGroup: rbac.authorization.k8s.io
---
# Source: terraform/templates/sync-workspace-deployment.yaml
# The deployment for running the sync-catalog pod
apiVersion: apps/v1
kind: Deployment
metadata:
  name: terraform-terraform-sync-workspace
  namespace: default
  labels:
    app: terraform
    chart: terraform-helm
    heritage: Helm
    release: terraform
spec:
  replicas: 1
  selector:
    matchLabels:
      app: terraform
      chart: terraform-helm
      release: terraform
      component: sync-workspace
  template:
    metadata:
      labels:
        app: terraform
        chart: terraform-helm
        release: terraform
        component: sync-workspace
    spec:
      serviceAccountName: terraform-terraform-sync-workspace
      containers:
        - name: terraform-sync-workspace
          image: "hashicorp/terraform-k8s:1.1.2"
          imagePullPolicy: "IfNotPresent"
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: "terraform-k8s"
            - name: TF_VERSION
              value: "latest"
            - name: TF_CLI_CONFIG_FILE
              value: "/etc/terraform/.terraformrc"
            - name: TF_URL
              value: ""
          volumeMounts:
          - name: terraformrc
            mountPath: "/etc/terraform"
            readOnly: true
          - name: sensitivevars
            mountPath: "/tmp/secrets"
            readOnly: true
          command:
            - /bin/terraform-k8s
          args:
            - --enable-leader-election
            - --k8s-watch-namespace=default
          livenessProbe:
            httpGet:
              path: /metrics
              port: 8383
              scheme: HTTP
            failureThreshold: 3
            initialDelaySeconds: 30
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /metrics
              port: 8383
              scheme: HTTP
            failureThreshold: 5
            initialDelaySeconds: 10
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 5
      volumes:
        - name: terraformrc
          secret:
            secretName: terraformrc
            items:
            - key: credentials
              path: ".terraformrc"
        - name: sensitivevars
          secret:
            secretName: workspacesecrets