---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: webhooks
  namespace: system
  labels:
    app: webhooks
spec:
  selector:
    matchLabels:
      app: webhooks
  replicas: 1
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: webhooks
      labels:
        app: webhooks
    spec:
      volumes:
      - name: webhooks-tls
        secret:
          secretName: webhooks-tls
      containers:
        - command:
          - python
          - /main.py
          volumeMounts:
          - name: webhooks-tls
            mountPath: "/tmp/serving-certs"
            readOnly: true
          env:
          - name: SERVICE_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: SERVICE_NAME
            value: webhooks
            # valueFrom:
            #   fieldRef:
            #     fieldPath: metadata.name
          ports:
          - containerPort: 8443
          image: jackhoman/webhooks:latest
          imagePullPolicy: Never
          name: webhooks
          securityContext:
            allowPrivilegeEscalation: false
          resources:
            limits:
              cpu: 500m
              memory: 128Mi
            requests:
              cpu: 10m
              memory: 64Mi
      serviceAccountName: webhooks
      terminationGracePeriodSeconds: 10
