---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: security-profiles-operator-webhook
  namespace: security-profiles-operator
spec:
  replicas: 3
  selector:
    matchLabels:
      name: security-profiles-operator-webhook
  template:
    metadata:
      annotations:
        openshift.io/scc: privileged
        seccomp.security.alpha.kubernetes.io/pod: runtime/default
      labels:
        name: security-profiles-operator-webhook
    spec:
      serviceAccountName: spo-webhook
      containers:
        - name: security-profiles-operator
          image: security-profiles-operator
          args:
          - webhook
          imagePullPolicy: Always
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
          volumeMounts:
          - name: cert
            mountPath: /tmp/k8s-webhook-server/serving-certs
            readOnly: true
          ports:
          - containerPort: 9443
            name: webhook
            protocol: TCP
      volumes:
      - name: cert
        secret:
          defaultMode: 420
          secretName: webhook-server-cert
      tolerations:
        - key: "node-role.kubernetes.io/master"
          operator: "Exists"
          effect: "NoSchedule"
        - key: "node-role.kubernetes.io/control-plane"
          operator: "Exists"
          effect: "NoSchedule"
        - key: "node.kubernetes.io/not-ready"
          operator: "Exists"
          effect: "NoExecute"
