apiVersion: apps/v1
kind: Deployment
metadata:
  name: admission-webhook-deployment
  namespace: kubeflow
  labels:
    app: admission-webhook
    app.kubernetes.io/component: poddefaults
    app.kubernetes.io/name: poddefaults
    kustomize.component: admission-webhook
spec:
  selector:
    matchLabels:
      app: admission-webhook
      app.kubernetes.io/component: poddefaults
      app.kubernetes.io/name: poddefaults
      kustomize.component: admission-webhook
  template:
    metadata:
      labels:
        app: admission-webhook
        app.kubernetes.io/component: poddefaults
        app.kubernetes.io/name: poddefaults
        kustomize.component: admission-webhook
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      serviceAccountName: admission-webhook-service-account
      containers:
      - name: admission-webhook
        image: gcr.io/gcp-private-dev/mirror/gcr.io/kubeflow-images-public/admission-webhook:vmaster-gaf96e4e3
        args:
        - --tlsCertFile=/etc/webhook/certs/tls.crt
        - --tlsKeyFile=/etc/webhook/certs/tls.key
        volumeMounts:
        - name: webhook-cert
          readOnly: true
          mountPath: /etc/webhook/certs
      volumes:
      - name: webhook-cert
        secret:
          secretName: webhook-certs
