Install

# Modelplane prerequisites. Apply once after installing Crossplane.
#
# These resources grant Crossplane and provider-helm the permissions
# Modelplane's compositions need, and configure provider-helm and
# provider-kubernetes. They cannot be self-composed because Crossplane
# needs the permissions before it can compose anything.
---
apiVersion: v1
kind: Namespace
metadata:
  name: modelplane-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: crossplane-compose-modelplane
  labels:
    rbac.crossplane.io/aggregate-to-crossplane: "true"
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["*"]
# Usages, which order teardown between composed resources. Everything else
# Modelplane composes lands on a workload cluster inside a provider-kubernetes
# Object or a provider-helm Release, so it needs no permission here: the
# providers carry their own, and reach the cluster with its kubeconfig.
- apiGroups: ["protection.crossplane.io"]
  resources: ["usages"]
  verbs: ["*"]
---
# Give provider-helm a deterministic SA name so we can grant it
# permissions. Without this, the SA name has a random hash.
apiVersion: pkg.crossplane.io/v1beta1
kind: DeploymentRuntimeConfig
metadata:
  name: provider-helm-modelplane
spec:
  serviceAccountTemplate:
    metadata:
      name: provider-helm-modelplane
---
# Grant provider-helm cluster-admin. It installs full Helm charts
# (MetalLB, Envoy Gateway, LeaderWorkerSet, Grove, etc.) that create arbitrary
# resource types across namespaces.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: provider-helm-modelplane
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: provider-helm-modelplane
  namespace: crossplane-system
---
# Apply the DRC to provider-helm automatically via ImageConfig.
apiVersion: pkg.crossplane.io/v1beta1
kind: ImageConfig
metadata:
  name: provider-helm-modelplane
spec:
  matchImages:
  - type: Prefix
    prefix: xpkg.upbound.io/upbound/provider-helm
  runtime:
    configRef:
      name: provider-helm-modelplane
---
# Stop provider-kubernetes copying Secret data into Object status.
#
# It writes an observed object's whole manifest to status.atProvider.manifest,
# so for an Object whose manifest is a Secret, that Secret's data is readable by
# anyone who can get objects, which is a wider audience than can get secrets.
# Modelplane composes Secrets holding caller API keys and serving certificate
# private keys, so this redacts them.
#
# Redaction applies to a copy used only for status. Drift detection still reads
# the unredacted object, so this doesn't cause an Object to be perpetually out
# of date.
apiVersion: pkg.crossplane.io/v1beta1
kind: DeploymentRuntimeConfig
metadata:
  name: provider-kubernetes-modelplane
spec:
  deploymentTemplate:
    spec:
      selector: {}
      template:
        spec:
          containers:
          - name: package-runtime
            args:
            - --sanitize-secrets
---
apiVersion: pkg.crossplane.io/v1beta1
kind: ImageConfig
metadata:
  name: provider-kubernetes-modelplane
spec:
  matchImages:
  - type: Prefix
    prefix: xpkg.upbound.io/upbound/provider-kubernetes
  runtime:
    configRef:
      name: provider-kubernetes-modelplane