apiVersion: v1
kind: Namespace
metadata:
  name: awp-system
  labels:
    app.kubernetes.io/part-of: awp
    awp.dev/control-plane-access: "true"
---
apiVersion: v1
kind: Namespace
metadata:
  name: awp-workspaces
  labels:
    app.kubernetes.io/part-of: awp
    awp.dev/execution-trust: untrusted
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: awp-workspace-controller
  namespace: awp-system
automountServiceAccountToken: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: awp-workspace-manager
  namespace: awp-workspaces
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log", "persistentvolumeclaims", "services", "serviceaccounts"]
    verbs: ["get", "list", "watch", "create", "patch", "delete"]
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["awp-ghcr-pull"]
    verbs: ["get"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["networkpolicies"]
    verbs: ["get", "list", "watch", "create", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: awp-workspace-controller
  namespace: awp-workspaces
subjects:
  - kind: ServiceAccount
    name: awp-workspace-controller
    namespace: awp-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: awp-workspace-manager
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: awp-workspace-quota
  namespace: awp-workspaces
spec:
  hard:
    requests.cpu: "16"
    requests.memory: 32Gi
    limits.cpu: "32"
    limits.memory: 64Gi
    persistentvolumeclaims: "32"
    requests.storage: 250Gi
---
apiVersion: v1
kind: LimitRange
metadata:
  name: awp-workspace-defaults
  namespace: awp-workspaces
spec:
  limits:
    - type: Container
      defaultRequest:
        cpu: 250m
        memory: 512Mi
      default:
        cpu: "2"
        memory: 4Gi
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: awp-workspaces
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
  ingress: []
  egress: []
