apiVersion: v1
kind: Namespace
metadata:
  name: kourier-system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: config-logging
  namespace: kourier-system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: config-observability
  namespace: kourier-system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: config-leader-election
  namespace: kourier-system
data:
  _example: |
        ################################
        #                              #
        #    EXAMPLE CONFIGURATION     #
        #                              #
        ################################

        # This block is not actually functional configuration,
        # but serves to illustrate the available configuration
        # options and document them in a way that is accessible
        # to users that `kubectl edit` this config map.
        #
        # These sample configuration options may be copied out of
        # this example block and unindented to be in the data block
        # to actually change the configuration.

        # resourceLock controls which API resource is used as the basis for the
        # leader election lock. Valid values are:
        #
        # - leases -> use the coordination API
        # - configmaps -> use configmaps
        # - endpoints -> use endpoints
        resourceLock: "leases"

        # leaseDuration is how long non-leaders will wait to try to acquire the
        # lock; 15 seconds is the value used by core kubernetes controllers.
        leaseDuration: "15s"
        # renewDeadline is how long a leader will try to renew the lease before
        # giving up; 10 seconds is the value used by core kubernetes controllers.
        renewDeadline: "10s"
        # retryPeriod is how long the leader election client waits between tries of
        # actions; 2 seconds is the value used by core kubernetes controllers.
        retryPeriod: "2s"
        # enabledComponents is a comma-delimited list of component names for which
        # leader election is enabled. Valid values are:
        # - controller
        # - hpaautoscaler
        # - certcontroller
        # - istiocontroller
        # - nscontroller
        # - kourier
  enabledComponents: kourier
---
apiVersion: v1
kind: Service
metadata:
  name: kourier
  namespace: kourier-system
spec:
  ports:
    - name: http2
      port: 80
      protocol: TCP
      targetPort: 8080
    - name: https
      port: 443
      protocol: TCP
      targetPort: 8443
  selector:
    app: 3scale-kourier-gateway
  type: LoadBalancer
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: 3scale-kourier-gateway
  namespace: kourier-system
spec:
  selector:
    matchLabels:
      app: 3scale-kourier-gateway
  template:
    metadata:
      labels:
        app: 3scale-kourier-gateway
    spec:
      containers:
        - args:
            - -c
            - /tmp/config/envoy-bootstrap.yaml
          command:
            - /usr/local/bin/envoy
          image: docker.io/maistra/proxyv2-ubi8:1.1.0
          imagePullPolicy: Always
          name: kourier-gateway
          ports:
            - name: http2
              containerPort: 8080
              protocol: TCP
            - name: https
              containerPort: 8443
              protocol: TCP
          volumeMounts:
            - name: config-volume
              mountPath: /tmp/config
          lifecycle:
            preStop:
              exec:
                command: ["curl","-X","POST","--unix","/tmp/envoy.admin","http://localhost/healthcheck/fail"]
          readinessProbe:
            httpGet:
              httpHeaders:
                - name: Host
                  value: internalkourier
              path: /ready
              port: 8081
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 5
      volumes:
        - name: config-volume
          configMap:
            name: kourier-bootstrap
      restartPolicy: Always
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: 3scale-kourier-control
  namespace: kourier-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: 3scale-kourier-control
  template:
    metadata:
      labels:
        app: 3scale-kourier-control
    spec:
      containers:
        - image: ko://knative.dev/net-kourier/cmd/kourier
          imagePullPolicy: Always
          name: kourier-control
          env:
            - name: CERTS_SECRET_NAMESPACE
              value: ""
            - name: CERTS_SECRET_NAME
              value: ""
            - name: SYSTEM_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
      restartPolicy: Always
      serviceAccountName: 3scale-kourier
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: 3scale-kourier
  namespace: kourier-system
rules:
  - apiGroups: [""]
    resources: ["pods", "endpoints", "namespaces", "services", "secrets", "configmaps"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["networking.internal.knative.dev"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.internal.knative.dev"]
    resources: ["ingresses/status"]
    verbs: ["update"]
  - apiGroups: [ "apiextensions.k8s.io" ]
    resources: [ "customresourcedefinitions" ]
    verbs: ["get", "list", "watch"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: 3scale-kourier
  namespace: kourier-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: 3scale-kourier
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: 3scale-kourier
subjects:
  - kind: ServiceAccount
    name: 3scale-kourier
    namespace: kourier-system
---
apiVersion: v1
kind: Service
metadata:
  name: kourier-internal
  namespace: kourier-system
spec:
  ports:
    - name: http2
      port: 80
      protocol: TCP
      targetPort: 8081
  selector:
    app: 3scale-kourier-gateway
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  name: kourier-control
  namespace: kourier-system
spec:
  ports:
    - port: 18000
      protocol: TCP
      targetPort: 18000
  selector:
    app: 3scale-kourier-control
  type: ClusterIP
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: kourier-bootstrap
  namespace: kourier-system
data:
  envoy-bootstrap.yaml: |
    dynamic_resources:
      ads_config:
        api_type: GRPC
        grpc_services:
          - envoy_grpc:
              cluster_name: xds_cluster
      cds_config:
        ads: {}
      lds_config:
        ads: {}
    node:
      cluster: kourier-knative
      id: 3scale-kourier-gateway
    static_resources:
      listeners:
        - name: stats_listener
          address:
            socket_address:
              address: 0.0.0.0
              port_value: 9000
          filter_chains:
            - filters:
                - name: envoy.http_connection_manager
                  config:
                    stat_prefix: stats_server
                    route_config:
                      virtual_hosts:
                        - name: admin_interface
                          domains:
                            - "*"
                          routes:
                            - match:
                                regex: '/(certs|stats(/prometheus)?|server_info|clusters|listeners|ready)?'
                                headers:
                                  - name: ':method'
                                    exact_match: GET
                              route:
                                cluster: service_stats
                    http_filters:
                      - name: envoy.router
                        config: {}
      clusters:
        - name: service_stats
          connect_timeout: 0.250s
          type: static
          load_assignment:
            cluster_name: service_stats
            endpoints:
              lb_endpoints:
                endpoint:
                  address:
                    pipe:
                      path: /tmp/envoy.admin
        - name: xds_cluster
          connect_timeout: 1s
          hosts:
            - socket_address:
                address: "kourier-control"
                port_value: 18000
          http2_protocol_options: {}
          type: STRICT_DNS
    admin:
      access_log_path: "/dev/stdout"
      address:
        pipe:
          path: /tmp/envoy.admin
