---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jupyterhub
  labels:
    app.kubernetes.io/name: jupyterhub
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: jupyterhub
  template:
    metadata:
      labels:
        app.kubernetes.io/name: jupyterhub
    spec:
      containers:
        - name: jupyterhub
          image: {{ JUPYTER_DOCKER_IMAGE_HUB }}
          env:
            - name: JUPYTERHUB_CRYPT_KEY
              value: "{{ JUPYTER_HUB_CRYPT_KEY }}"
            - name: SPAWNER
              value: kubernetes
          ports:
            - containerPort: 9045
            - containerPort: 8081
          volumeMounts:
            - mountPath: /srv/jupyterhub/
              name: config
      serviceAccountName: jupyterhub
      volumes:
        - name: config
          configMap:
            name: jupyterhub-config
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jupyterhub
  labels:
    app.kubernetes.io/name: jupyterhub
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: jupyterhub
  labels:
    app.kubernetes.io/name: jupyterhub
rules:
  - apiGroups: [""]
    resources: ["pods", "persistentvolumeclaims", "secrets", "services"]
    verbs: ["get", "watch", "list", "create", "delete"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["get", "watch", "list"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: jupyterhub
  labels:
    app.kubernetes.io/name: jupyterhub
subjects:
  - kind: ServiceAccount
    name: jupyterhub
    namespace: "{{ K8S_NAMESPACE }}"
roleRef:
  kind: Role
  name: jupyterhub
  apiGroup: rbac.authorization.k8s.io

