{{- if .ServiceAccount }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Service }}
---
{{- if (and .OpenShift (eq .Service "tproxy")) }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: privileged-scc-{{ .Service }}-{{ .Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:openshift:scc:privileged
subjects:
- kind: ServiceAccount
  name: {{ .Service }}
  namespace: {{ .Namespace }}
---
{{- end }}
{{- end }}
apiVersion: v1
kind: Service
metadata:
  name: {{ .Service }}
{{- if .ServiceLabels }}
  labels:
    app: {{ .Service }}
{{- range $name, $value := .ServiceLabels }}
    {{$name}}: "{{$value}}"
{{- end }}
{{- else}}
  labels:
    app: {{ .Service }}
{{- end }}
{{- if .ServiceAnnotations }}
  annotations:
{{- range $name, $value := .ServiceAnnotations }}
    {{ $name }}: {{ printf "%q" $value }}
{{- end }}
{{- end }}
spec:
{{- if .IPFamilies }}
  ipFamilies: [ {{ .IPFamilies }} ]
{{- end }}
{{- if .IPFamilyPolicy }}
  ipFamilyPolicy: {{ .IPFamilyPolicy }}
{{- end }}
{{- if .Headless }}
  clusterIP: None
{{- end }}
  ports:
{{- range $i, $p := .ServicePorts }}
  - name: {{ $p.Name }}
    port: {{ $p.ServicePort }}
    targetPort: {{ $p.WorkloadPort }}
{{- end }}
  selector:
    app: {{ .Service }}
