apiVersion: apps/v1
kind: Deployment
metadata:
  name: azure-defender-proxy-deployment
  namespace: kube-system
  labels:
    app: azdproxy
    admission.azdproxy.sh/ignore: no-self-managing  # This field assigned in order to verify that this resource won't be mutated by azdproxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: azdproxy
  template:
    metadata:
      labels:
        app: azdproxy
        admission.azdproxy.sh/ignore: no-self-managing # This field assigned in order to verify that this resource won't be mutated by azdproxy
    spec:
      serviceAccountName: azure-defender-proxy-admin
      containers: # TODO : Add securityContext section.
        - name: azure-defender-proxy-webhook
          image: azdproxy-image
          imagePullPolicy: Always # Never for debugging, in production change to Always
          ports:
            - containerPort: 8000 # The port on which the service will send requests to, so the wh be listening on.
          volumeMounts:
            - name: cert
              readOnly: true
              mountPath: /certs
          resources:
            limits:
              memory: "128Mi"
              cpu: "500m"
      volumes:
        - name: cert
          secret:
            secretName: azure-defender-cert