---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: appmesh-inject
  namespace: appmesh-system
  labels:
    name: appmesh-inject
spec:
  replicas: 1
  selector:
    matchLabels:
      name: appmesh-inject
  template:
    metadata:
      name: appmesh-inject
      labels:
        name: appmesh-inject
    spec:
      serviceAccountName: appmesh-inject
      containers:
        - name: webhook
          image: 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-app-mesh-inject:v0.1.6
          env:
            - name: APPMESH_REGION
              value: eu-west-1
            - name: APPMESH_NAME
              value: mymesh
            - name: APPMESH_LOG_LEVEL
              value: info
          imagePullPolicy: Always
          command:
            - ./appmeshinject
            - -sidecar-image=840364872350.dkr.ecr.us-west-2.amazonaws.com/aws-appmesh-envoy:v1.12.5.0-prod
            - -init-image=111345817488.dkr.ecr.us-west-2.amazonaws.com/aws-appmesh-proxy-route-manager:v2
            - -inject-xray-sidecar=false
            - -enable-stats-tags=false
            - -enable-statsd=false
            - -inject-statsd-exporter-sidecar=false
            - -sidecar-cpu-requests=100m
            - -sidecar-memory-requests=128Mi
            - -tlscert=/etc/webhook/certs/tls.crt
            - -tlskey=/etc/webhook/certs/tls.key
          resources:
            limits:
              memory: 500Mi
              cpu: 300m
            requests:
              memory: 500Mi
              cpu: 300m
          volumeMounts:
            - name: webhook-certs
              mountPath: /etc/webhook/certs
              readOnly: true
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8080
              scheme: HTTPS
            initialDelaySeconds: 1
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
              scheme: HTTPS
            initialDelaySeconds: 5
            periodSeconds: 10
          securityContext:
            readOnlyRootFilesystem: true
      volumes:
        - name: webhook-certs
          secret:
            secretName: appmesh-inject
