-
Notifications
You must be signed in to change notification settings - Fork 139
/
deployment.yaml
69 lines (68 loc) · 1.99 KB
/
deployment.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
apiVersion: apps/v1
kind: Deployment
metadata:
name: pod-identity-webhook
namespace: openshift-cloud-credential-operator
spec:
replicas: 2
selector:
matchLabels:
app: pod-identity-webhook
template:
metadata:
annotations:
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
labels:
app: pod-identity-webhook
spec:
containers:
- name: pod-identity-webhook
image: ${IMAGE}
imagePullPolicy: IfNotPresent
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: [ "ALL" ]
command:
- /usr/bin/aws-pod-identity-webhook
- --in-cluster=false
- --tls-cert=/var/run/app/certs/tls.crt
- --tls-key=/var/run/app/certs/tls.key
- --namespace=openshift-cloud-credential-operator
- --port=9443
- --service-name=pod-identity-webhook
- --annotation-prefix=eks.amazonaws.com # TODO: use openshift.io based prefix
- --token-audience=sts.amazonaws.com
- --logtostderr
resources:
requests:
cpu: 10m
memory: 10Mi
volumeMounts:
- name: webhook-certs
mountPath: /var/run/app/certs
readOnly: false
nodeSelector:
node-role.kubernetes.io/master: ""
priorityClassName: system-cluster-critical
serviceAccountName: pod-identity-webhook
securityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
tolerations:
- effect: NoSchedule
key: node-role.kubernetes.io/master
operator: Exists
- effect: NoExecute
key: node.kubernetes.io/unreachable
operator: Exists
tolerationSeconds: 120
- effect: NoExecute
key: node.kubernetes.io/not-ready
operator: Exists
tolerationSeconds: 120
volumes:
- name: webhook-certs
secret:
secretName: pod-identity-webhook