forked from kubernetes-sigs/gateway-api
-
Notifications
You must be signed in to change notification settings - Fork 0
/
admission_webhook.yaml
86 lines (86 loc) · 2.15 KB
/
admission_webhook.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
name: gateway-api-admission
webhooks:
- name: validate.gateway.networking.k8s.io
matchPolicy: Equivalent
rules:
- operations: [ "CREATE" , "UPDATE" ]
apiGroups: [ "gateway.networking.k8s.io" ]
apiVersions: [ "v1alpha2", "v1beta1" ]
resources: [ "gateways", "gatewayclasses", "httproutes" ]
failurePolicy: Fail
sideEffects: None
admissionReviewVersions:
- v1
clientConfig:
service:
name: gateway-api-admission-server
namespace: gateway-system
path: "/validate"
---
apiVersion: v1
kind: Service
metadata:
labels:
name: gateway-api-webhook-server
name: gateway-api-admission-server
namespace: gateway-system
spec:
type: ClusterIP
ports:
- name: https-webhook
port: 443
targetPort: 8443
selector:
name: gateway-api-admission-server
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: gateway-api-admission-server
namespace: gateway-system
labels:
name: gateway-api-admission-server
spec:
replicas: 1
selector:
matchLabels:
name: gateway-api-admission-server
template:
metadata:
name: gateway-api-admission-server
labels:
name: gateway-api-admission-server
spec:
containers:
- name: webhook
image: gcr.io/k8s-staging-gateway-api/admission-server:v0.6.0-rc2
imagePullPolicy: Always
args:
- -logtostderr
- --tlsCertFile=/etc/certs/cert
- --tlsKeyFile=/etc/certs/key
- -v=10
- 2>&1
ports:
- containerPort: 8443
name: webhook
resources:
limits:
memory: 50Mi
cpu: 100m
requests:
memory: 50Mi
cpu: 100m
volumeMounts:
- name: webhook-certs
mountPath: /etc/certs
readOnly: true
securityContext:
readOnlyRootFilesystem: true
volumes:
- name: webhook-certs
secret:
secretName: gateway-api-admission