Move all bots to designated namespaces

4 files changed, 76 insertions, 0 deletions

diff --git a/kubernetes/namespaces/bots/king-arthur/README.md b/kubernetes/namespaces/bots/king-arthur/README.md
new file mode 100644
index 0000000..704d45b
--- /dev/null
+++ b/kubernetes/namespaces/bots/king-arthur/README.md
@@ -0,0 +1,12 @@
+# King Arthur
+
+Deployment file for @King Arthur, our DevOps helper bot.
+
+## Secrets
+This deployment expects a number of secrets and environment variables to exist in a secret called `king-arthur-env`.
+
+| Environment                  | Description                                                               |
+| ---------------------------- | ------------------------------------------------------------------------- |
+| KING_ARTHUR_TOKEN            | The token to authorize with Discord                                       |
+| KING_ARTHUR_NOTION_API_TOKEN | The API token to the notion API                                           |
+| KING_ARTHUR_CLOUDFLARE_TOKEN | A token for the Cloudflare API used for the Cloudflare commands in Arthur |
diff --git a/kubernetes/namespaces/bots/king-arthur/deployment.yaml b/kubernetes/namespaces/bots/king-arthur/deployment.yaml
new file mode 100644
index 0000000..b5250ba
--- /dev/null
+++ b/kubernetes/namespaces/bots/king-arthur/deployment.yaml
@@ -0,0 +1,36 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: king-arthur
+  namespace: bots
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: king-arthur
+  template:
+    metadata:
+      labels:
+        app: king-arthur
+    spec:
+      serviceAccountName: king-arthur
+      containers:
+      - name: king-arthur
+        image: ghcr.io/python-discord/king-arthur:latest
+        imagePullPolicy: Always
+        resources:
+          requests:
+            cpu: 600m
+            memory: 500Mi
+          limits:
+            cpu: 800m
+            memory: 800Mi
+        envFrom:
+        - secretRef:
+            name: king-arthur-env
+        securityContext:
+          readOnlyRootFilesystem: true
+      securityContext:
+        fsGroup: 2000
+        runAsUser: 1000
+        runAsNonRoot: true
diff --git a/kubernetes/namespaces/bots/king-arthur/secrets.yaml b/kubernetes/namespaces/bots/king-arthur/secrets.yaml
new file mode 100644
index 0000000..dda3686
--- /dev/null
+++ b/kubernetes/namespaces/bots/king-arthur/secrets.yaml
diff --git a/kubernetes/namespaces/bots/king-arthur/service-account.yaml b/kubernetes/namespaces/bots/king-arthur/service-account.yaml
new file mode 100644
index 0000000..c971205
--- /dev/null
+++ b/kubernetes/namespaces/bots/king-arthur/service-account.yaml
@@ -0,0 +1,28 @@
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: king-arthur
+rules:
+- apiGroups: ["", "extensions", "apps", "batch", "rbac.authorization.k8s.io", "cert-manager.io"]
+  resources: ["*"]
+  verbs: ["*"]
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: king-arthur
+  namespace: bots
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: king-arthur
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: king-arthur
+subjects:
+  - kind: ServiceAccount
+    name: king-arthur
+    namespace: bots