apiVersion: apps/v1
kind: Deployment
metadata:
  name: kit-webhook
  namespace: kit
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      control-plane: kit-webhook
  template:
    metadata:
      labels:
        control-plane: kit-webhook
    spec:
      priorityClassName: system-cluster-critical
      serviceAccountName: kit-webhook
      containers:
        - name: webhook
          image: ko://github.com/awslabs/kit/operator/cmd/webhook
          resources:
            limits:
              cpu: 100m
              memory: 50Mi
            requests:
              cpu: 100m
              memory: 50Mi
          ports:
            - name: webhook
              containerPort: 8443
          livenessProbe:
            httpGet:
              scheme: HTTPS
              port: 8443
          env:
            - name: KUBERNETES_MIN_VERSION
              value: v1.16.0
            - name: SYSTEM_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
      # https://github.com/aws/amazon-eks-pod-identity-webhook/issues/8#issuecomment-636888074
      securityContext:
        fsGroup: 1000