kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tbot
rules:
  - resources: ["pods", "nodes", "nodes/proxy"]
    apiGroups: [""]
    verbs: ["get"]

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tbot
rules:
  - resources: ["pods", "nodes", "nodes/proxy"]
    apiGroups: [""]
    verbs: ["get"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tbot
subjects:
  - kind: ServiceAccount
    name: tbot
    namespace: default
roleRef:
  kind: ClusterRole
  name: tbot
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tbot
  namespace: default
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: tbot-config
  namespace: default
data:
  tbot.yaml: |
    version: v2
    onboarding:
      join_method: kubernetes
      # 생성한 조인 토큰의 이름으로 바꿉니다.
      token: example-token
    storage:
      type: memory
    # Teleport 프록시 서비스의 주소로 이 값을 설정하십시오.
    proxy_server: example.teleport.sh:443
    services:
      - type: spiffe-workload-api
        listen: unix:///run/tbot/sockets/workload.sock
        attestor:
          kubernetes:
            enabled: true
            kubelet:
              # 일반적으로 클러스터 CA에서 발급되지 않는 Kubelet API 인증서의
              # 검증을 건너뜁니다.
              skip_verify: true
        # 발급하려는 SPIFFE ID로 svid 항목을 바꾸고,
        # 규칙 블록을 사용하여 특정 Kubernetes 워크로드로 이를 제한합니다.
        svids:
          - path: /my-service
            rules:
              - kubernetes:
                  namespace: default
                  service_account: example-sa
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: tbot
spec:
  selector:
    matchLabels:
      app: tbot
  template:
    metadata:
      labels:
        app: tbot
    spec:
      securityContext:
        runAsUser: 0
        runAsGroup: 0
      hostPID: true
      containers:
        - name: tbot
          image: public.ecr.aws/gravitational/tbot-distroless:17.0.0-dev
          imagePullPolicy: IfNotPresent
          securityContext:
            privileged: true
          args:
            - start
            - -c
            - /config/tbot.yaml
            - --log-format
            - json
          volumeMounts:
            - mountPath: /config
              name: config
            - mountPath: /var/run/secrets/tokens
              name: join-sa-token
            - name: tbot-sockets
              mountPath: /run/tbot/sockets
              readOnly: false
          env:
            - name: TELEPORT_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: KUBERNETES_TOKEN_PATH
              value: /var/run/secrets/tokens/join-sa-token
      serviceAccountName: tbot
      volumes:
        - name: tbot-sockets
          hostPath:
            path: /run/tbot/sockets
            type: DirectoryOrCreate
        - name: config
          configMap:
            name: tbot-config
        - name: join-sa-token
          projected:
            sources:
              - serviceAccountToken:
                  path: join-sa-token
                  # Kubernetes가 지원하는 최소값은 600초입니다. 이 값을 사용하는 것이 좋습니다.
                  expirationSeconds: 600
                  # `example.teleport.sh` 는 Teleport 클러스터의 이름으로 바꿔야 합니다.
                  audience: example.teleport.sh