---
# Source: gitlab-agent/templates/ocs/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: release-name-gitlab-agent-ocs-scanning-pod-sa
  namespace: gitlab
  labels:
    helm.sh/chart: gitlab-agent-2.2.0
    app.kubernetes.io/name: gitlab-agent
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "v17.0.1"
    app.kubernetes.io/managed-by: Helm
---
# Source: gitlab-agent/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: release-name-gitlab-agent
  labels:
    helm.sh/chart: gitlab-agent-2.2.0
    app.kubernetes.io/name: gitlab-agent
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "v17.0.1"
    app.kubernetes.io/managed-by: Helm
---
# Source: gitlab-agent/templates/ocs/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gitlab:release-name-gitlab-agent:ocs
  labels:
    helm.sh/chart: gitlab-agent-2.2.0
    app.kubernetes.io/name: gitlab-agent
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "v17.0.1"
    app.kubernetes.io/managed-by: Helm
rules:
- apiGroups:
  - batch
  resources:
  - cronjobs
  - jobs
  verbs:
  - list
  - get
- apiGroups:
  - ""
  resources:
  - pods
  - replicationcontrollers
  - serviceaccounts
  - namespaces
  verbs:
  - list
  - get
- apiGroups:
  - "apps"
  resources:
  - replicasets
  - daemonsets
  - statefulsets
  - deployments
  verbs:
  - list
  - get
---
# Source: gitlab-agent/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gitlab:release-name-gitlab-agent-cluster-admin
  labels:
    helm.sh/chart: gitlab-agent-2.2.0
    app.kubernetes.io/name: gitlab-agent
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "v17.0.1"
    app.kubernetes.io/managed-by: Helm
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: release-name-gitlab-agent
  namespace: gitlab
---
# Source: gitlab-agent/templates/ocs/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gitlab:release-name-gitlab-agent:ocs
  labels:
    helm.sh/chart: gitlab-agent-2.2.0
    app.kubernetes.io/name: gitlab-agent
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "v17.0.1"
    app.kubernetes.io/managed-by: Helm
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: gitlab:release-name-gitlab-agent:ocs
subjects:
- kind: ServiceAccount
  name: release-name-gitlab-agent-ocs-scanning-pod-sa
  namespace: gitlab
---
# Source: gitlab-agent/templates/ocs/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: release-name-gitlab-agent:ocs
  namespace: gitlab
  labels:
    helm.sh/chart: gitlab-agent-2.2.0
    app.kubernetes.io/name: gitlab-agent
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "v17.0.1"
    app.kubernetes.io/managed-by: Helm
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
---
# Source: gitlab-agent/templates/ocs/rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: release-name-gitlab-agent:ocs
  namespace: gitlab
  labels:
    helm.sh/chart: gitlab-agent-2.2.0
    app.kubernetes.io/name: gitlab-agent
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "v17.0.1"
    app.kubernetes.io/managed-by: Helm
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: release-name-gitlab-agent:ocs
subjects:
- kind: ServiceAccount
  name: release-name-gitlab-agent-ocs-scanning-pod-sa
  namespace: gitlab
---
# Source: gitlab-agent/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  # NOTE: the `-v1` suffix was introduced as an epoch version to be able
  # to gracefully recreate the deployment in case there is no upgrade
  # path otherwise, e.g. when changing an immutable field.
  # see https://gitlab.com/gitlab-org/charts/gitlab-agent/-/issues/38 for ctx
  name: release-name-gitlab-agent-v2
  labels:
    helm.sh/chart: gitlab-agent-2.2.0
    app.kubernetes.io/name: gitlab-agent
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "v17.0.1"
    app.kubernetes.io/managed-by: Helm
spec:
  replicas: 2
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
    type: RollingUpdate
  selector:
    matchLabels:
      app.kubernetes.io/name: gitlab-agent
      app.kubernetes.io/instance: release-name
  template:
    metadata:
      annotations:        
        prometheus.io/path: /metrics
        prometheus.io/port: "8080"
        prometheus.io/scrape: "true"
      labels:
        helm.sh/chart: gitlab-agent-2.2.0
        app.kubernetes.io/name: gitlab-agent
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/version: "v17.0.1"
        app.kubernetes.io/managed-by: Helm
    spec:
      automountServiceAccountToken: false
      serviceAccountName: release-name-gitlab-agent
      securityContext:
        {}
      containers:
        - name: gitlab-agent
          securityContext:
            {}
          image: registry.gitlab.com/gitlab-org/cluster-integration/gitlab-agent/agentk:v17.0.1
          imagePullPolicy: IfNotPresent
          terminationMessagePolicy: FallbackToLogsOnError
          args:
            - --token-file=/etc/agentk/secrets/token
            - --kas-address=wss://kas.gitlab.com
          ports:
            - name: observability
              containerPort: 8080
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /liveness
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /readiness
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            {}
          env:
            - name: POD_NAMESPACE
              valueFrom:
               fieldRef:
                 fieldPath: metadata.namespace
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: SERVICE_ACCOUNT_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.serviceAccountName
            - name: OCS_ENABLED
              value: "true"
            - name: OCS_SERVICE_ACCOUNT_NAME
              value: release-name-gitlab-agent-ocs-scanning-pod-sa
          volumeMounts:
            - name: service-account-token-volume
              mountPath: /var/run/secrets/kubernetes.io/serviceaccount
              readOnly: true
      volumes:
        - name: service-account-token-volume
          projected:
            defaultMode: 0444
            sources:
            - configMap:
                name: kube-root-ca.crt
            - downwardAPI:
                items:
                - fieldRef:
                    apiVersion: v1
                    fieldPath: metadata.namespace
                  path: namespace
            - serviceAccountToken:
                expirationSeconds: 3600
                path: token