apiVersion: apps/v1
kind: Deployment
metadata:
  name: validation-webhook
  namespace: bridgecrew
  labels:
    app: validate
spec:
  replicas: 2
  selector:
    matchLabels:
      app: validate
  strategy:
      type: RollingUpdate
      rollingUpdate:
        maxSurge: 1
        maxUnavailable: 0
  template:
    metadata:
      labels:
        app: validate
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: "docker/default"
    spec:
      containers:
      - name: webhook
        securityContext:
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          capabilities:
            drop:
              - ALL
              - NET_RAW
        image: bridgecrew/whorf@sha256:5011533b845cb5e248d6e59248b9f963a6b88a73bf0d8a57d2b20223529c07a0
        resources:
          limits:
            cpu: "1"
            memory: "500Mi"
          requests:
            cpu: "0.1"
            memory: "100Mi"
        readinessProbe:
          initialDelaySeconds: 15
          exec:
            command:
              - /bin/sh
              - -c 
              - "pidof -x gunicorn"
        livenessProbe:
          initialDelaySeconds: 30
          exec:
            command:
              - /bin/sh
              - -c 
              - "pidof -x gunicorn"
        ports:
        - containerPort: 8443
        env:
        - name: BC_SOURCE
          value: admissionController
        - name: CKV_GITHUB_CONFIG_FETCH_DATA
          value: "False"
        volumeMounts:
        - name: bridgecrew-secret
          readOnly: true
          mountPath: "/home/app/.bridgecrew"
        - name: certs-volume
          readOnly: true
          mountPath: "/certs"
        - name: "config"
          mountPath: "/app/config"
        - name: "apptmp"
          mountPath: "/app/tmp"
        - name: "tmp"
          mountPath: "/tmp"
        imagePullPolicy: Always
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 11000
        runAsGroup: 11000
      volumes:
      - name: bridgecrew-secret
        secret:
          secretName: bridgecrew-secret
      - name: certs-volume
        secret:
          secretName: admission-tls
      - name: "config"
        configMap:
          name: "checkovconfig"
      - emptyDir: {}
        name: apptmp
      - emptyDir: {}
        name: tmp
