apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: kuberos
  name: kuberos
  namespace: kuberos
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: kuberos
  template:
    metadata:
      labels:
        app.kubernetes.io/name: kuberos
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
      containers:
        - name: kuberos
          image: qqbuby/kuberos:v0.1.0
          env:
            - name: REQUIRED_IMAGE_REGISTRY
              value: docker.io
            - name: REQUIRED_IMAGE_ORG
              value: qqbuby
          command:
            - /kuberos
            - serve
            - --port=8080
            - --tls-cert-file=/usr/local/certificates/cert 
            - --tls-private-key-file=/usr/local/certificates/key 
            - -v=5
          volumeMounts:
            - mountPath: /usr/local/certificates/
              name: webhook-cert
              readOnly: true
          ports:
            - name: webhook
              containerPort: 8080
          resources:
            requests:
              cpu: 50m
              memory: 50Mi
            limits:
              cpu: 50m
              memory: 50Mi
          livenessProbe:
            httpGet:
              scheme: HTTPS
              path: /livez
              port: 8080
          readinessProbe:
            httpGet:
              scheme: HTTPS
              path: /readyz
              port: 8080
      volumes: 
        - name: webhook-cert
          secret:
            secretName: kuberos-admission 
