apiVersion: v1
kind: ServiceAccount
metadata:
  name: commitkube
  namespace: commitkube
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: commitkube
rules:
  # Leitura do cluster: overview, navegador, triage, service map# Cluster reads: overview, browser, triage, service map
  - apiGroups: [""]
    resources: ["pods", "nodes", "namespaces", "services", "endpoints",
                "persistentvolumeclaims", "configmaps"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["resourcequotas", "limitranges", "serviceaccounts"]
    verbs: ["get", "list"]
  - apiGroups: ["apps"]
    resources: ["deployments", "replicasets", "daemonsets", "statefulsets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["batch"]
    resources: ["cronjobs", "jobs"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses", "ingressclasses", "networkpolicies"]
    verbs: ["get", "list", "watch"]
  # Métricas: metrics-server e o cadvisor de cada kubelet# Metrics: metrics-server and each kubelet's cadvisor
  - apiGroups: ["metrics.k8s.io"]
    resources: ["pods", "nodes"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["nodes/proxy", "nodes/metrics", "pods/log"]
    verbs: ["get"]
  # Ações: restart, scale, limpeza de ReplicaSets# Actions: restart, scale, ReplicaSet cleanup
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["delete"]
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["delete"]
  - apiGroups: ["apps"]
    resources: ["deployments/scale", "replicasets/scale", "statefulsets/scale"]
    verbs: ["get", "update"]
  # Página de Secrets (remova "update" para deixá-la só leitura)# Secrets page (drop "update" to keep it read-only)
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "update"]
  - apiGroups: ["external-secrets.io"]
    resources: ["externalsecrets", "secretstores", "clustersecretstores"]
    verbs: ["get", "list"]
  # Security Posture: avaliação das regras de RBAC# Security Posture: assessing the RBAC rules
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["roles", "clusterroles", "rolebindings", "clusterrolebindings"]
    verbs: ["get", "list"]
  # Istio (opcional)# Istio (optional)
  - apiGroups: ["networking.istio.io"]
    resources: ["virtualservices"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: commitkube
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: commitkube
subjects:
  - kind: ServiceAccount
    name: commitkube
    namespace: commitkube

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: commitkube-data
  namespace: commitkube
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 10Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: commitkube
  namespace: commitkube
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels: { app: commitkube }
  template:
    metadata:
      labels: { app: commitkube }
    spec:
      serviceAccountName: commitkube
      containers:
        - name: commitkube
          image: commitkube/commitkube:v1.0.6
          ports:
            - containerPort: 80
          envFrom:
            - secretRef:
                name: commitkube-secrets
          env:
            - name: DEFAULT_CLUSTER_NAME
              value: production
          volumeMounts:
            - name: data
              mountPath: /app/data
          readinessProbe:
            tcpSocket: { port: 80 }
            initialDelaySeconds: 5
          resources:
            requests: { cpu: 250m, memory: 512Mi }
            limits:   { memory: 2Gi }
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: commitkube-data
---
apiVersion: v1
kind: Service
metadata:
  name: commitkube
  namespace: commitkube
spec:
  selector: { app: commitkube }
  ports:
    - port: 80
      targetPort: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: commitkube
  namespace: commitkube
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 50m
spec:
  ingressClassName: nginx
  tls:
    - hosts: ["commitkube.example.com"]
      secretName: commitkube-tls
  rules:
    - host: commitkube.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: commitkube
                port: { number: 80 }