apiVersion: apps/v1
kind: Deployment
metadata:
  name: pod-security-webhook
  namespace: pod-security-webhook
  labels:
    app: pod-security-webhook
spec:
  selector:
    matchLabels:
      app: pod-security-webhook
  template:
    metadata:
      labels:
        app: pod-security-webhook
    spec:
      serviceAccountName: pod-security-webhook
      priorityClassName: system-cluster-critical
      volumes:
        - name: config
          configMap:
            name: pod-security-webhook
        - name: pki
          secret:
            secretName: pod-security-webhook
      containers:
        - name: pod-security-webhook
          image: k8s.gcr.io/sig-auth/pod-security-webhook:v1.22-alpha.0
          terminationMessagePolicy: FallbackToLogsOnError
          ports:
            - containerPort: 8443
          args:
            [
              "--config",
              "/etc/config/podsecurityconfiguration.yaml",
              "--tls-cert-file",
              "/etc/pki/tls.crt",
              "--tls-private-key-file",
              "/etc/pki/tls.key",
              "--secure-port",
              "8443",
            ]
          resources:
            requests:
              cpu: 100m
            limits:
              cpu: 500m
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: config
              mountPath: "/etc/config"
              readOnly: true
            - name: pki
              mountPath: "/etc/pki"
              readOnly: true
