apiVersion: apps/v1
kind: Deployment
metadata:
  name: webhook-service
  labels:
    control-plane: webhook-service
spec:
  selector:
    matchLabels:
      control-plane: webhook-service
  replicas: 1
  template:
    metadata:
      labels:
        control-plane: webhook-service
        idp-antiaffinity-selector: idp-mgmt-operator-webhook
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: idp-antiaffinity-selector
                      operator: In
                      values:
                        - idp-mgmt-operator-webhook
                topologyKey: topology.kubernetes.io/zone
              weight: 70
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: idp-antiaffinity-selector
                      operator: In
                      values:
                        - idp-mgmt-operator-webhook
                topologyKey: kubernetes.io/hostname
              weight: 35
      containers:
        - args:
            - webhook
            - "--secure-port=6443"
            - "--tls-cert-file=/serving-cert/tls.crt"
            - "--tls-private-key-file=/serving-cert/tls.key"
            - -v 5
          image: quay.io/identitatem/idp-mgmt-operator:latest
          name: webhook
          imagePullPolicy: Always
          volumeMounts:
            - name: webhook-secret
              mountPath: "/serving-cert"
              readOnly: true
      volumes:
        - name: webhook-secret
          secret:
            secretName: idp-mgmt-webhook
      serviceAccountName: idp-mgmt-operator-webhook-service
      terminationGracePeriodSeconds: 10
      tolerations:
        - key: node-role.kubernetes.io/infra
          operator: Exists
          effect: NoSchedule
        - key: dedicated
          operator: Exists
          effect: NoSchedule
