# Source: tekton-pipeline/templates/tekton-pipelines-webhook-deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: default
    app.kubernetes.io/name: webhook
    app.kubernetes.io/part-of: tekton-pipelines
    app.kubernetes.io/version: v0.23.0
    pipeline.tekton.dev/release: v0.23.0
    version: v0.23.0
    gitops.jenkins-x.io/pipeline: 'namespaces'
  name: tekton-pipelines-webhook
  namespace: tekton-pipelines
  annotations:
    wave.pusher.com/update-on-config-change: 'true'
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: webhook
      app.kubernetes.io/instance: default
      app.kubernetes.io/name: webhook
      app.kubernetes.io/part-of: tekton-pipelines
  template:
    metadata:
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
      labels:
        app: tekton-pipelines-webhook
        app.kubernetes.io/component: webhook
        app.kubernetes.io/instance: default
        app.kubernetes.io/name: webhook
        app.kubernetes.io/part-of: tekton-pipelines
        app.kubernetes.io/version: v0.23.0
        pipeline.tekton.dev/release: v0.23.0
        version: v0.23.0
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/component: webhook
                    app.kubernetes.io/instance: default
                    app.kubernetes.io/name: webhook
                    app.kubernetes.io/part-of: tekton-pipelines
                topologyKey: kubernetes.io/hostname
              weight: 100
      containers:
        - env:
            - name: SYSTEM_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: CONFIG_LOGGING_NAME
              value: config-logging
            - name: CONFIG_OBSERVABILITY_NAME
              value: config-observability
            - name: CONFIG_LEADERELECTION_NAME
              value: config-leader-election
            - name: WEBHOOK_SERVICE_NAME
              value: tekton-pipelines-webhook
            - name: WEBHOOK_SECRET_NAME
              value: webhook-certs
            - name: METRICS_DOMAIN
              value: tekton.dev/pipeline
          image: gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/webhook:v0.23.0@sha256:fbc317c68da9cc406cce58508869b35b240fc11034efffac113ed1f980ee3c7a
          livenessProbe:
            httpGet:
              path: /health
              port: probes
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
          name: webhook
          ports:
            - containerPort: 9090
              name: metrics
            - containerPort: 8008
              name: profiling
            - containerPort: 8443
              name: https-webhook
            - containerPort: 8080
              name: probes
          readinessProbe:
            httpGet:
              path: /readiness
              port: probes
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
          resources:
            limits:
              cpu: 500m
              memory: 500Mi
            requests:
              cpu: 100m
              memory: 100Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - all
            runAsGroup: 65532
            runAsUser: 65532
      serviceAccountName: tekton-pipelines-webhook
