apiVersion: v1
kind: Namespace
metadata:
  labels:
    control-plane: controller-manager
  name: wireguard-system
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.8.0
  creationTimestamp: null
  name: wireguardpeers.vpn.wireguard-operator.io
spec:
  group: vpn.wireguard-operator.io
  names:
    kind: WireguardPeer
    listKind: WireguardPeerList
    plural: wireguardpeers
    singular: wireguardpeer
  scope: Namespaced
  versions:
  - name: v1alpha1
    schema:
      openAPIV3Schema:
        description: WireguardPeer is the Schema for the wireguardpeers API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: The desired state of the peer.
            properties:
              PrivateKeyRef:
                description: The private key of the peer
                properties:
                  secretKeyRef:
                    description: SecretKeySelector selects a key of a Secret.
                    properties:
                      key:
                        description: The key of the secret to select from.  Must be a valid secret key.
                        type: string
                      name:
                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
                        type: string
                      optional:
                        description: Specify whether the Secret or its key must be defined
                        type: boolean
                    required:
                    - key
                    type: object
                required:
                - secretKeyRef
                type: object
              address:
                description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster Important: Run "make" to regenerate code after modifying this file The address of the peer.'
                type: string
              disabled:
                description: Set to true to temporarily disable the peer.
                type: boolean
              dns:
                description: The DNS configuration for the peer.
                type: string
              downloadSpeed:
                properties:
                  config:
                    type: integer
                  unit:
                    enum:
                    - mbps
                    - kbps
                    type: string
                type: object
              egressNetworkPolicies:
                description: Egress network policies for the peer.
                items:
                  properties:
                    action:
                      description: Specifies the action to take when outgoing traffic from a Wireguard peer matches the policy. This could be 'Accept' or 'Reject'.
                      enum:
                      - ACCEPT
                      - REJECT
                      - Accept
                      - Reject
                      type: string
                    protocol:
                      description: Specifies the protocol to match for this policy. This could be TCP, UDP, or ICMP.
                      enum:
                      - TCP
                      - UDP
                      - ICMP
                      type: string
                    to:
                      description: A struct that specifies the destination address and port for the traffic. This could include IP addresses or hostnames, as well as specific port numbers or port ranges.
                      properties:
                        ip:
                          description: A string field that specifies the destination IP address for traffic that matches the policy.
                          type: string
                        port:
                          description: An integer field that specifies the destination port number for traffic that matches the policy.
                          format: int32
                          type: integer
                      type: object
                  type: object
                type: array
              publicKey:
                description: The key used by the peer to authenticate with the wg server.
                type: string
              uploadSpeed:
                properties:
                  config:
                    type: integer
                  unit:
                    enum:
                    - mbps
                    - kbps
                    type: string
                type: object
              wireguardRef:
                description: The name of the Wireguard instance in k8s that the peer belongs to. The wg instance should be in the same namespace as the peer.
                minLength: 1
                type: string
            required:
            - wireguardRef
            type: object
          status:
            description: A field that defines the observed state of the Wireguard peer. This includes fields like the current configuration and status of the peer.
            properties:
              config:
                description: 'INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file A string field that contains the current configuration for the Wireguard peer.'
                type: string
              message:
                description: A string field that provides additional information about the status of the Wireguard peer. This could include error messages or other information that helps to diagnose issues with the peer.
                type: string
              status:
                description: A string field that represents the current status of the Wireguard peer. This could include values like ready, pending, or error.
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.8.0
  creationTimestamp: null
  name: wireguards.vpn.wireguard-operator.io
spec:
  group: vpn.wireguard-operator.io
  names:
    kind: Wireguard
    listKind: WireguardList
    plural: wireguards
    singular: wireguard
  scope: Namespaced
  versions:
  - name: v1alpha1
    schema:
      openAPIV3Schema:
        description: Wireguard is the Schema for the wireguards API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: WireguardSpec defines the desired state of Wireguard
            properties:
              address:
                description: A string field that specifies the address for the Wireguard VPN server. This is the public IP address or hostname that peers will use to connect to the VPN.
                type: string
              dns:
                description: A string field that specifies the DNS server(s) to be used by the peers.
                type: string
              enableIpForwardOnPodInit:
                description: A boolean field that specifies whether IP forwarding should be enabled on the Wireguard VPN pod at startup. This can be useful to enable if the peers are having problems with sending traffic to the internet.
                type: boolean
              mtu:
                description: A string field that specifies the maximum transmission unit (MTU) size for Wireguard packets for all peers.
                type: string
              port:
                description: A field that specifies the value to use for a nodePort ServiceType
                format: int32
                type: integer
              serviceAnnotations:
                additionalProperties:
                  type: string
                description: A map of key value strings for service annotations
                type: object
              serviceType:
                description: A field that specifies the type of Kubernetes service that should be used for the Wireguard VPN. This could be NodePort or LoadBalancer, depending on the needs of the deployment.
                type: string
              useWgUserspaceImplementation:
                description: A boolean field that specifies whether to use the userspace implementation of Wireguard instead of the kernel one.
                type: boolean
            type: object
          status:
            description: WireguardStatus defines the observed state of Wireguard
            properties:
              address:
                description: A string field that specifies the address for the Wireguard VPN server that is currently being used.
                type: string
              dns:
                type: string
              message:
                description: A string field that provides additional information about the status of Wireguard. This could include error messages or other information that helps to diagnose issues with the wg instance.
                type: string
              port:
                description: A string field that specifies the port for the Wireguard VPN server that is currently being used.
                type: string
              status:
                description: A string field that represents the current status of Wireguard. This could include values like ready, pending, or error.
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: wireguard-controller-manager
  namespace: wireguard-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: wireguard-leader-election-role
  namespace: wireguard-system
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: wireguard-manager-role
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - apps
  resources:
  - deployments
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - apps
  resources:
  - pods
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - vpn.wireguard-operator.io
  resources:
  - wireguardpeers
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - vpn.wireguard-operator.io
  resources:
  - wireguardpeers/finalizers
  verbs:
  - update
- apiGroups:
  - vpn.wireguard-operator.io
  resources:
  - wireguardpeers/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - vpn.wireguard-operator.io
  resources:
  - wireguards
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - vpn.wireguard-operator.io
  resources:
  - wireguards/finalizers
  verbs:
  - update
- apiGroups:
  - vpn.wireguard-operator.io
  resources:
  - wireguards/status
  verbs:
  - get
  - patch
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: wireguard-metrics-reader
rules:
- nonResourceURLs:
  - /metrics
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: wireguard-proxy-role
rules:
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: wireguard-leader-election-rolebinding
  namespace: wireguard-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: wireguard-leader-election-role
subjects:
- kind: ServiceAccount
  name: wireguard-controller-manager
  namespace: wireguard-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: wireguard-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: wireguard-manager-role
subjects:
- kind: ServiceAccount
  name: wireguard-controller-manager
  namespace: wireguard-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: wireguard-proxy-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: wireguard-proxy-role
subjects:
- kind: ServiceAccount
  name: wireguard-controller-manager
  namespace: wireguard-system
---
apiVersion: v1
data:
  controller_manager_config.yaml: |
    apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
    kind: ControllerManagerConfig
    health:
      healthProbeBindAddress: :8081
    metrics:
      bindAddress: 127.0.0.1:8080
    webhook:
      port: 9443
    leaderElection:
      leaderElect: true
      resourceName: a6d3bffc.wireguard-operator.io
kind: ConfigMap
metadata:
  name: wireguard-manager-config
  namespace: wireguard-system
---
apiVersion: v1
kind: Service
metadata:
  labels:
    control-plane: controller-manager
  name: wireguard-controller-manager-metrics-service
  namespace: wireguard-system
spec:
  ports:
  - name: https
    port: 8443
    protocol: TCP
    targetPort: https
  selector:
    control-plane: controller-manager
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    control-plane: controller-manager
  name: wireguard-controller-manager
  namespace: wireguard-system
spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: controller-manager
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: manager
      labels:
        control-plane: controller-manager
    spec:
      containers:
      - args:
        - --secure-listen-address=0.0.0.0:8443
        - --upstream=http://127.0.0.1:8080/
        - --logtostderr=true
        - --v=0
        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
        name: kube-rbac-proxy
        ports:
        - containerPort: 8443
          name: https
          protocol: TCP
        resources:
          limits:
            cpu: 500m
            memory: 128Mi
          requests:
            cpu: 5m
            memory: 64Mi
      - args:
        - --health-probe-bind-address=:8081
        - --metrics-bind-address=127.0.0.1:8080
        - --leader-elect
        - --agent-image=ghcr.io/jodevsa/wireguard-operator/agent:v2.1.0
        command:
        - /manager
        image: ghcr.io/jodevsa/wireguard-operator/manager:v2.1.0
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 15
          periodSeconds: 20
        name: manager
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        resources:
          limits:
            cpu: 500m
            memory: 128Mi
          requests:
            cpu: 10m
            memory: 64Mi
        securityContext:
          allowPrivilegeEscalation: false
      securityContext:
        runAsNonRoot: true
      serviceAccountName: wireguard-controller-manager
      terminationGracePeriodSeconds: 10