---

kind: Namespace
apiVersion: v1
metadata:
    name: cattle-system

---

kind: ServiceAccount
apiVersion: v1
metadata:
    name: cattle-admin
    namespace: cattle-system

---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
    name: cattle-crb
    namespace: cattle-system
subjects:
  - kind: ServiceAccount
    name: cattle-admin
    namespace: cattle-system
roleRef:
    kind: ClusterRole
    name: cluster-admin
    apiGroup: rbac.authorization.k8s.io

---

apiVersion: v1
kind: Secret
metadata:
    name: cattle-keys-server
    namespace: cattle-system
type: Opaque
data:
  url: "aHR0cHM6Ly9yYW5jaGVyLmt1YmVybmF1dHMuZGU="
  token: "dHdocWhia3M3ZnI3NXE0c2RzczRmYmZzNjR3emx2Y3R2ZnF0bjdxZ3hoNzdqaDkycWpwMnpm"

---

apiVersion: v1
kind: Service
metadata:
    namespace: cattle-system
    name: cattle-service
    labels:
      app: cattle
spec:
    ports:
    - port: 80
      targetPort: 80
      protocol: TCP
      name: http
    - port: 443
      targetPort: 443
      protocol: TCP
      name: https
    selector:
      app: cattle
    type: NodePort

---

kind: Deployment
apiVersion: extensions/v1beta1
metadata:
    namespace: cattle-system
    name: cattle
spec:
    replicas: 1
    template:
      metadata:
        labels:
          app: cattle
      spec:
        serviceAccountName: cattle-admin
        containers:
        - image: rancher/rancher:latest
          imagePullPolicy: Always
          name: cattle-server
          ports:
          - containerPort: 80
            protocol: TCP
          - containerPort: 443
            protocol: TCP
          volumeMounts:
          - mountPath: /etc/rancher/ssl
            name: cattle-keys-volume
            readOnly: true
        volumes:
        - name: cattle-keys-volume
          secret:
            defaultMode: 420
            secretName: cattle-keys-server