---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vault-injector
  labels:
    app.kubernetes.io/name: vault-injector
    app.kubernetes.io/instance: vault
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: vault-injector
      app.kubernetes.io/instance: vault
  template:
    metadata:
      labels:
        app.kubernetes.io/name: vault-injector
        app.kubernetes.io/instance: vault
    spec:
      serviceAccountName: "vault-injector"
      containers:
        - name: sidecar-injector
          image: "openlabred/vault-k8s:latest"
          imagePullPolicy: IfNotPresent
          env:
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: AGENT_INJECT_LISTEN
              value: ":8080"
            - name: AGENT_INJECT_LOG_LEVEL
              value: "info"
            - name: AGENT_INJECT_LOG_FORMAT
              value: "standard"
            - name: AGENT_INJECT_VAULT_ADDR
              value: "https://vault.$(NAMESPACE).svc:8200"
            - name: AGENT_INJECT_VAULT_IMAGE
              value: "vault:1.3.2"
            - name: AGENT_INJECT_TLS_AUTO
              value: vault-agent-injector-cfg
            - name: AGENT_INJECT_TLS_AUTO_HOSTS
              value: "vault-agent-injector-svc,vault-agent-injector-svc.$(NAMESPACE),vault-agent-injector-svc.$(NAMESPACE).svc"
          args:
            - agent-inject
            - 2>&1
          resources:
            requests:
              memory: 256Mi
              cpu: 250m
            limits:
              memory: 256Mi
              cpu: 250m
          livenessProbe:
            httpGet:
              path: /health/ready
              port: 8080
              scheme: HTTPS
            failureThreshold: 2
            initialDelaySeconds: 1
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /health/ready
              port: 8080
              scheme: HTTPS
            failureThreshold: 2
            initialDelaySeconds: 2
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 5
