apiVersion: v1
kind: Namespace
metadata:
  name: kf-csb
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: csb-user
  namespace: kf-csb
  annotations:
    iam.gke.io/gcp-service-account: <GSA_NAME>
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-csb
  namespace: kf-csb
spec:
  podSelector:
    matchLabels:
      app: csb-controller
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          app.kubernetes.io/name: kf
        ports:
    - podSelector:
        matchLabels:
          app: controller
  - ports:
    - protocol: TCP
      port: 80
---
apiVersion: v1
kind: Service
metadata:
  namespace: kf-csb
  name: csb-controller
  labels:
    app: csb-controller
spec:
  selector:
    app: csb-controller
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: kf-csb
  name: csb-controller
spec:
  replicas: 1 # CSB can only run with 1 replica because it hasn't yet support concurrent read/write to the same DB from multiple pods.
  selector:
    matchLabels:
      app: csb-controller
  template:
    metadata:
      labels:
        app: csb-controller
    spec:
      serviceAccountName: csb-user
      containers:
      - name: controller
        image: gcr.io/kf-releases/csb:v1.0.0
        imagePullPolicy: Always
        command: ["/bin/cloud-service-broker"]
        args: ["serve", "--config", "/csb-config/config.yml"]
        volumeMounts:
        - name: config
          mountPath: /csb-config
        env:
          - name: PORT
            value: "80"
      - name: cloud-sql-proxy
        image: gcr.io/cloudsql-docker/gce-proxy:1.17
        command:
          - "/cloud_sql_proxy"
          # Defaults: MySQL: 3306, Postgres: 5432, SQLServer: 1433
          - "-instances=<INSTANCE_CONNECTION_NAME>=tcp:<DB_PORT>"
        securityContext:
          runAsNonRoot: true
        resources:
          requests:
            memory: "2Gi"
            cpu:    "1"
      volumes:
      - name: config
        secret:
          secretName: csb-secret