apiVersion: v1
kind: ConfigMap
metadata:
  name: tsi-mutate-webhook-configmap
data:
  tsiMutateConfig.yaml: |
      initContainers:
      - name: gen-vault-cert
        image: trustedseriviceidentity/ti-gen-vault-cert:v1.5
        imagePullSecrets:
        - name: regcred
        imagePullPolicy: Always
        volumeMounts:
          - name: pod-metadata
            mountPath: /pod-metadata
            readOnly: true
          - name: ti-sa-mount
            mountPath: /var/run/secrets/kubernetes.io/serviceaccount
            readOnly: true
          - name: ti-keys
            mountPath: /keys
            readOnly: true
      volumes:
        - name: pod-metadata
          downwardAPI:
            items:
              - path: "ti-identity"
                fieldRef:
                  fieldPath: metadata.annotations['admission.trusted.identity/ti-identity']
              - path: "ti-pod-name"
                fieldRef:
                  fieldPath: metadata.name
              - path: "ti-pod-namespace"
                fieldRef:
                  fieldPath: metadata.namespace
              - path: "tsi-images"
                fieldRef:
                  fieldPath: metadata.annotations['admission.trusted.identity/tsi-images']
        - name: ti-keys
          secret:
            secretName: ti-keys-config
        - name: ti-sa-mount
          secret:
            secretName: ${TI_SA_TOKEN}
      addVolumeMounts:
        - name: tsi-secrets
          mountPath: /tsi-secrets
          readOnly: true
