webhook-k8s-resources.template.yaml

apiVersion: v1
kind: Secret
metadata:
  name: k8s-delete-validation-webhook-secret
  namespace: default
data:
  tls_private_key: ${WEBHOOK_TLS_PRIVATE_KEY_B64}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8s-delete-validation-webhook-config
  namespace: default
data:
  tls_cert: |
    ${WEBHOOK_TLS_CERT}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: k8s-delete-validation-webhook
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: k8s-delete-validation-webhook
  template:
    metadata:
      labels:
        app: k8s-delete-validation-webhook
    spec:
      containers:
        - name: k8s-delete-validation-webhook
          image: ${WEBHOOK_IMAGE}
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 443
          env:
            #ANNOTATION_PREFIX_NAME_PLACEHOLDER
              #ANNOTATION_PREFIX_VALUE_PLACEHOLDER
            - name: TLS_CERT_FILE
              value: /data/ssl_certs/server-cert.pem
            - name: TLS_PRIVATE_KEY_FILE
              value: /data/ssl_keys/server-key.pem
            - name: LISTEN_PORT
              value: "443"
            - name: DEPLOYMENT_DELETION_FAILED_MESSAGE
              value: "The deployment cannot be deleted as deletions are locked for this deployment"
            - name: DEPLOYMENT_DELETION_LOCK_LABEL_KEY
              value: "deleteLock"
            - name: DEPLOYMENT_DELETION_LOCK_LABEL_VALUE
              value: "enabled"
          volumeMounts:
            - name: ssl-certs
              mountPath: "/data/ssl_certs"
              readOnly: true
            - name: ssl-keys
              mountPath: "/data/ssl_keys"
              readOnly: true
      volumes:
        - name: ssl-certs
          configMap:
            name: k8s-delete-validation-webhook-config
            items:
              - key: tls_cert
                path: server-cert.pem
        - name: ssl-keys
          secret:
            secretName: k8s-delete-validation-webhook-secret
            items:
              - key: tls_private_key
                path: server-key.pem
---
apiVersion: v1
kind: Service
metadata:
  name: k8s-delete-validation-webhook 
  namespace: default
spec:
  ports:
  - port: 443
    targetPort: 443
  selector:
    app: k8s-delete-validation-webhook
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: k8s-delete-validation-webhook-cfg
webhooks:
  - name: k8s-deletion-validation-webhook.test.com
    clientConfig:
      service:
        name: k8s-delete-validation-webhook
        namespace: default
        path: "/validate"
      caBundle: ${WEBHOOK_CA_BUNDLE}
    rules:
      - operations: ["DELETE"]
        apiGroups: ["*"]
        apiVersions: ["*"]
        resources: ["deployments","DebugAttachments","debugattachments"]
    failurePolicy: Fail
    namespaceSelector:
      matchLabels:
        webhook: enabled