apiVersion: apps/v1
kind: Deployment
metadata:
  name: pod-identity-webhook
  namespace: kube-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: pod-identity-webhook
  template:
    metadata:
      labels:
        app: pod-identity-webhook
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - pod-identity-webhook
              topologyKey: "kubernetes.io/hostname"
          # This is a little redundant since masters are going to be in different zones anyways
          - weight: 50   
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - pod-identity-webhook
              topologyKey: topology.kubernetes.io/zone
      serviceAccountName: pod-identity-webhook
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
        operator: Exists
      nodeSelector:
        kubernetes.io/role: master
      containers:
      - name: pod-identity-webhook
        image: IMAGE
        imagePullPolicy: Always
        command:
        - /webhook
        - --in-cluster
        - --namespace=kube-system
        - --service-name=pod-identity-webhook
        - --tls-secret=pod-identity-webhook
        - --annotation-prefix=eks.amazonaws.com
        - --token-audience=sts.amazonaws.com
        - --logtostderr
        resources:
          limits:
            cpu: 200m
            memory: 64Mi
          requests:
            cpu: 200m
            memory: 64Mi
        volumeMounts:
        - name: webhook-certs
          mountPath: /var/run/app/certs
          readOnly: false
      volumes:
      - name: webhook-certs
        emptyDir: {}
