# Copyright (c) 2018 Intel Corporation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http:#www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: net-attach-def-admission-controller-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: net-attach-def-admission-controller
  template:
    metadata:
      labels:
        app: net-attach-def-admission-controller
    spec:
      containers:
      - name: net-attach-def-admission-controller
        image: nfvpe/net-attach-def-admission-controller:snapshot
        command:
        - ./bin/webhook
        args:
        - -bind-address=0.0.0.0
        - -port=443
        - -tls-private-key-file=/etc/webhook/key.pem
        - -tls-cert-file=/etc/webhook/cert.pem
        - -alsologtostderr=true
        - -metrics-listen-address=0.0.0.0:9091
        volumeMounts:
        - name: webhook-certs
          mountPath: /etc/webhook
          readOnly: True
        imagePullPolicy: IfNotPresent
      - name: kube-rbac-proxy
        image: quay.io/coreos/kube-rbac-proxy:v0.4.1
        args:
        - --logtostderr
        - --secure-listen-address=0.0.0.0:8443
        - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
        - --upstream=http://127.0.0.1:9091/
        - --tls-private-key-file=/etc/webhook/key.pem
        - --tls-cert-file=/etc/webhook/cert.pem
        env:
          - name: IP
            valueFrom:
              fieldRef:
                fieldPath: status.podIP
        ports:
          - containerPort: 8443
            hostPort: 8443
            name: https
        resources:
          requests:
            cpu: 1m
            memory: 30Mi
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
          - name: webhook-certs
            mountPath: /etc/webhook
            readOnly: True
      serviceAccountName: net-attach-def-admission-controller-sa
      volumes:
      - name: webhook-certs
        secret:
          secretName: net-attach-def-admission-controller-secret
