apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gitlab-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: gitlab
    namespace: kube-system

---
- name: Add Traefik's chart repository.
  community.kubernetes.helm_repository:
    name: traefik
    repo_url: "https://helm.traefik.io/traefik"

- name: Install Traefik with Helm.
  community.kubernetes.helm:
    name: traefik
    chart_ref: traefik/traefik
    update_repo_cache: yes
    release_namespace: traefik
    create_namespace: yes
    values: "{{ lookup('template', 'traefik-chart-values.yaml') | from_yaml }}"

#
# Advanced K8s settings
#
rbac:
  enabled: true
tolerations:
  - key: "CriticalAddonsOnly"
    operator: "Exists"
  - key: "node-role.kubernetes.io/master"
    operator: "Exists"
    effect: "NoSchedule"

#
# Configure providers
#
providers:
  kubernetesIngress:
    publishedService:
      enabled: true
#
# Create an IngressRoute for the dashboard
#
ingressRoute:
  dashboard:
    enabled: true

# Configure ports
ports:
  # The name of this one can't be changed as it is used for the readiness and
  # liveness probes, but you can adjust its config to your liking
  traefik:
    port: 9000
    # Use hostPort if set.
    # hostPort: 9000
    #
    # Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which
    # means it's listening on all your interfaces and all your IPs. You may want
    # to set this value if you need traefik to listen on specific interface
    # only.
    # hostIP: 192.168.100.10

    # Defines whether the port is exposed if service.type is LoadBalancer or
    # NodePort.
    #
    # You SHOULD NOT expose the traefik port on production deployments.
    # If you want to access it from outside of your cluster,
    # use `kubectl port-forward` or create a secure ingress
    expose: true
    # The exposed port for this service
    exposedPort: 9000
    # The port protocol (TCP/UDP)
    protocol: TCP
  web:
    port: 8000
    # hostPort: 8000
    expose: true
    exposedPort: 80
    # The port protocol (TCP/UDP)
    protocol: TCP
    # Use nodeport if set. This is useful if you have configured Traefik in a
    # LoadBalancer
    # nodePort: 32080
    # Port Redirections
    # Added in 2.2, you can make permanent redirects via entrypoints.
    # https://docs.traefik.io/routing/entrypoints/#redirection
    # redirectTo: websecure
  websecure:
    port: 8443
    # hostPort: 8443
    expose: true
    exposedPort: 443
    # The port protocol (TCP/UDP)
    protocol: TCP
    # nodePort: 32443
    # Set TLS at the entrypoint
    # https://doc.traefik.io/traefik/routing/entrypoints/#tls
    tls:
      enabled: true
      # this is the name of a TLSOption definition
      options: ""
      certResolver: ""
      domains: []
      # - main: example.com
      #   sans:
      #     - foo.example.com
      #     - bar.example.com

#
# Things that I felt more comfortable setting via the CLI
#
additionalArguments:
  - "--certificatesresolvers.letsencrypt.acme.email=myemail@email.test"
  - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
  - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
  - "--api.insecure=true"
  - "--accesslog=true"
  - "--log.level=ERROR"

services:
  - name: docker:dind
    alias: docker

stages:
  - deploy

deploy to production:
  stage: deploy
  image: 
    name: bitnami/kubectl:latest
    entrypoint: [""]
  script:
    - kubectl apply -f deployment.yml
  environment:
    name: production

---
apiVersion: v1
kind: Pod
metadata:
  name: alpha-whoami
  labels:
    app: alpha-whoami
    namespace: alpha-test-8-production
spec:
  containers:
    - name: alpha-whoami
      image: containous/whoami:latest
      ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: alpha-whoami
  namespace: alpha-test-8-production
spec:
  ports:
    - port: 80
      protocol: TCP
      targetPort: 80
  selector:
    app: alpha-whoami
  type: ClusterIP
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: alpha-whoami
  namespace: traefik
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`alpha.test`)
      kind: Rule
      services:
        - name: alpha-whoami
          port: 80

---
apiVersion: v1
kind: Pod
metadata:
  name: alpha-whoami
  labels:
    app: alpha-whoami
spec:
  containers:
    - name: alpha-whoami
      image: containous/whoami:latest
      ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: alpha-whoami
spec:
  ports:
    - port: 80
      protocol: TCP
      targetPort: 80
  selector:
    app: alpha-whoami
  type: ClusterIP
---
kind: Ingress
apiVersion: extensions/v1beta1
metadata:
  name: ingress-alpha
spec:
  rules:
    - host: alpha.test
      http:
        paths:
          - path: /
            backend:
              serviceName: alpha-whoami
              servicePort: 80