apiVersion: v1
kind: Namespace
metadata:
  name: overdeck-observability
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: overdeck-collector
  namespace: overdeck-observability
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: overdeck-observer
rules:
  - apiGroups: [""]
    resources: ["nodes", "nodes/proxy", "namespaces", "pods", "pods/status", "events"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["batch"]
    resources: ["jobs", "jobs/status"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["events.k8s.io"]
    resources: ["events"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: overdeck-observer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: overdeck-observer
subjects:
  - kind: ServiceAccount
    name: overdeck-collector
    namespace: overdeck-observability
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kube-state-metrics
  namespace: overdeck-observability
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: overdeck-kube-state-metrics
rules:
  - apiGroups: [""]
    resources: ["nodes", "namespaces", "pods"]
    verbs: ["list", "watch"]
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: overdeck-kube-state-metrics
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: overdeck-kube-state-metrics
subjects:
  - kind: ServiceAccount
    name: kube-state-metrics
    namespace: overdeck-observability
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kube-state-metrics
  namespace: overdeck-observability
spec:
  replicas: 1
  selector:
    matchLabels: {app.kubernetes.io/name: kube-state-metrics}
  template:
    metadata:
      labels: {app.kubernetes.io/name: kube-state-metrics}
    spec:
      serviceAccountName: kube-state-metrics
      containers:
        - name: kube-state-metrics
          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0
          args:
            - --resources=nodes,namespaces,pods,jobs
          ports:
            - {name: http-metrics, containerPort: 8080}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 65534
            capabilities: {drop: ["ALL"]}
---
apiVersion: v1
kind: Service
metadata:
  name: kube-state-metrics
  namespace: overdeck-observability
spec:
  selector: {app.kubernetes.io/name: kube-state-metrics}
  ports:
    - {name: http-metrics, port: 8080, targetPort: http-metrics}
