{{- if .Values.scrapeRules.etcd.enabled }}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-rbac-proxy
  namespace: cozy-monitoring
  labels:
    app.kubernetes.io/name: etcd
    app.kubernetes.io/instance: etcd
    app.kubernetes.io/part-of: control-plane
    app.kubernetes.io/component: kube-rbac-proxy
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: etcd
      app.kubernetes.io/instance: etcd
      app.kubernetes.io/part-of: control-plane
      app.kubernetes.io/component: kube-rbac-proxy
  template:
    metadata:
      labels:
        app.kubernetes.io/name: etcd
        app.kubernetes.io/instance: etcd
        app.kubernetes.io/part-of: control-plane
        app.kubernetes.io/component: kube-rbac-proxy
    spec:
      serviceAccountName: kube-rbac-proxy
      hostNetwork: true
      nodeSelector:
        node-role.kubernetes.io/control-plane: ""
      containers:
      - name: kube-rbac-proxy
        image: quay.io/brancz/kube-rbac-proxy:v0.11.0
        args:
        - "--secure-listen-address=$(NODE_IP):9443"
        - "--upstream=http://127.0.0.1:2381/"
        env:
        - name: NODE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        ports:
        - containerPort: 9443
          name: etcd-metrics
        securityContext:
          runAsUser: 1000
          runAsNonRoot: true

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kube-rbac-proxy
  namespace: cozy-monitoring

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kube-rbac-proxy-auth
rules:
  - apiGroups: ["authentication.k8s.io"]
    resources: ["tokenreviews"]
    verbs: ["create"]
  - apiGroups: ["authorization.k8s.io"]
    resources: ["subjectaccessreviews"]
    verbs: ["create"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kube-rbac-proxy-auth-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kube-rbac-proxy-auth
subjects:
  - kind: ServiceAccount
    name: kube-rbac-proxy
    namespace: cozy-monitoring

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: etcd-metrics-reader
rules:
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: etcd-metrics-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: etcd-metrics-reader
subjects:
- kind: ServiceAccount
  name: vmagent-vmagent
  namespace: cozy-monitoring

---
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMPodScrape
metadata:
  name: etcd-managment-scrape
spec:
  podMetricsEndpoints:
    - port: etcd-metrics
      scheme: https
      tlsConfig:
        insecureSkipVerify: true
      bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  selector:
    matchLabels:
      app.kubernetes.io/name: etcd
      app.kubernetes.io/instance: etcd
      app.kubernetes.io/part-of: control-plane
      app.kubernetes.io/component: kube-rbac-proxy
{{- end }}
