---
apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: openshift-cluster-monitoring-operator
  annotations:
    openshift.io/display-name: OpenShift Cluster Monitoring Operator
    description: The OpenShift Cluster Monitoring Operator manages the deployment of the OpenShift monitoring platform.
    iconClass: icon-openshift
    tags: openshift,infra,monitoring
    openshift.io/documentation-url: https://github.com/openshift/cluster-monitoring-operator
    openshift.io/support-url: https://access.redhat.com
openshift.io/provider-display-name: Red Hat, Inc.
parameters:
- name: ALERTMANAGER_CONFIG
  required: true
  description: A complete (base64-encoded) Alertmanager configuration YAML file.
- name: NAMESPACE
  # This namespace cannot be changed. Only `openshift-monitoring` is supported.
  required: true
  value: openshift-monitoring

objects:

# Configures Alertmanager.
- apiVersion: v1
  kind: Secret
  metadata:
    name: alertmanager-main
    namespace: ${NAMESPACE}
    labels:
      k8s-app: alertmanager
  data:
    alertmanager.yaml: "${ALERTMANAGER_CONFIG}"

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata: {name: cluster-monitoring-operator}
  rules:
  - apiGroups: [rbac.authorization.k8s.io]
    resources: [clusterrolebindings, clusterroles, rolebindings, roles]
    verbs: [create, delete, get, list, update, watch]
  - apiGroups: ['']
    resources: [configmaps, serviceaccounts]
    verbs: [create, delete, get, list, update, watch]
  - apiGroups: [apps]
    resources: [daemonsets, deployments]
    verbs: [create, delete, get, list, update, watch]
  - apiGroups: [route.openshift.io]
    resources: [routes]
    verbs: [create, delete, get, list, update, watch]
  - apiGroups: [security.openshift.io]
    resources: [securitycontextconstraints]
    verbs: [create, delete, get, list, update, watch]
  - apiGroups: [authentication.k8s.io]
    resources: [tokenreviews]
    verbs: [create]
  - apiGroups: [authorization.k8s.io]
    resources: [subjectaccessreviews]
    verbs: [create]
  - apiGroups: [apps]
    resources: [daemonsets, deployments, replicasets, statefulsets]
    verbs: [list, watch]
  - apiGroups: [extensions]
    resources: [daemonsets, deployments, replicasets]
    verbs: [list, watch]
  - apiGroups: [autoscaling]
    resources: [horizontalpodautoscalers]
    verbs: [list, watch]
  - apiGroups: [batch]
    resources: [cronjobs, jobs]
    verbs: [list, watch]
  - apiGroups: ['']
    resources: [configmaps, endpoints, limitranges, namespaces, nodes, persistentvolumeclaims,
      persistentvolumes, pods, replicationcontrollers, resourcequotas, secrets, services]
    verbs: [list, watch]
  - apiGroups: ['']
    resources: [pods]
    verbs: [get]
  - apiGroups: [apps]
    resourceNames: [kube-state-metrics]
    resources: [deployments]
    verbs: [get, update]
  - apiGroups: [extensions]
    resourceNames: [kube-state-metrics]
    resources: [deployments]
    verbs: [get, update]
  - apiGroups: ['']
    resources: [namespaces]
    verbs: [get]
  - apiGroups: ['']
    resources: [nodes/metrics]
    verbs: [get]
  - nonResourceURLs: [/metrics]
    verbs: [get]
  - apiGroups: ['']
    resources: [configmaps]
    verbs: [get]
  - apiGroups: ['']
    resources: [endpoints, nodes, pods, services]
    verbs: [get, list, watch]
  - apiGroups: ['']
    resources: [namespaces]
    verbs: [list, watch]
  - apiGroups: ['']
    resources: [nodes]
    verbs: [list, watch]
  - apiGroups: [monitoring.coreos.com]
    resources: [alertmanagers, alertmanagers/finalizers, prometheuses, prometheuses/finalizers,
      prometheusrules, servicemonitors]
    verbs: ['*']
  - apiGroups: ['']
    resources: [configmaps, secrets]
    verbs: ['*']
  - apiGroups: [apps]
    resources: [statefulsets]
    verbs: ['*']
  - apiGroups: ['']
    resources: [endpoints, services]
    verbs: [create, get, update]
  - apiGroups: ['']
    resources: [pods]
    verbs: [delete, list]
  - apiGroups: [apiextensions.k8s.io]
    resources: [customresourcedefinitions]
    verbs: ['*']
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: cluster-monitoring-operator
    namespace: ${NAMESPACE}
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: cluster-monitoring-operator
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: cluster-monitoring-operator
  subjects:
  - kind: ServiceAccount
    name: cluster-monitoring-operator
    namespace: ${NAMESPACE}
