webhook-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "fullname" . }}-webhook
  labels:
    app: {{ template "fullname" . }}-webhook
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  replicas: 1
  strategy: {{ toYaml .Values.webhook.strategy | nindent 4 }}
  minReadySeconds: {{ .Values.webhook.minReadySeconds }}
  selector:
    matchLabels:
      app: {{ template "fullname" . }}-webhook
  template:
    metadata:
      labels:
        {{- if .Values.podLabels }}
        {{- tpl (toYaml .Values.podLabels) $ | nindent 8 }}
        {{- end }}
        app: {{ template "fullname" . }}-webhook
        chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
        release: "{{ .Release.Name }}"
        releaseRevision: "{{ .Release.Revision }}"
        heritage: "{{ .Release.Service }}"
      {{- if .Values.webhook.annotations }}
      annotations:
{{ toYaml .Values.webhook.annotations | indent 8 }}
      {{- end }}
    spec:
{{- with .Values.securityContext }}
      securityContext:
{{ toYaml . | indent 8 }}
{{- end }}
      serviceAccountName: "{{ .Values.webhook.serviceAccount }}"
      {{- if .Values.priorityClassName }}
      priorityClassName: "{{ .Values.priorityClassName }}"
      {{- end }}
      imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
      containers:
      - name: svr
        image: {{ .Values.image }}
        imagePullPolicy: {{ .Values.imagePullPolicy }}
        resources:
{{ toYaml .Values.webhook.resources | indent 10 }}
        args:
        - webhook
        - --secure-port
        - "8443"
        - --healthz-server-bind-port
        - "8081"
        - -v
        - "{{ .Values.webhook.verbosity }}"
        - --feature-gates
        - OriginatingIdentity={{.Values.originatingIdentityEnabled}}
        - --feature-gates
        - ServicePlanDefaults={{.Values.servicePlanDefaultsEnabled}}
        {{- if .Values.namespacedServiceBrokerDisabled }}
        - --feature-gates
        - NamespacedServiceBroker=false
        {{- end }}
        ports:
        - containerPort: 8443
        volumeMounts:
        - name: service-catalog-webhook-cert
          mountPath: /var/run/service-catalog-webhook
          readOnly: true
        {{- if .Values.webhook.healthcheck.enabled }}
        readinessProbe:
          httpGet:
            port: 8081
            path: /healthz/ready
            scheme: HTTP
          failureThreshold: 1
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        livenessProbe:
          httpGet:
            port: 8081
            path: /healthz
            scheme: HTTP
          failureThreshold: 3
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        {{- end }}
{{- with .Values.affinity }}
      affinity: {{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
      {{- if or .Values.webhook.nodeSelector .Values.nodeSelector }}
      nodeSelector:
{{ toYaml (mustMerge .Values.webhook.nodeSelector .Values.nodeSelector) | indent 8 }}
      {{- end }}
{{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
{{- end }}
      volumes:
      - name: service-catalog-webhook-cert
        secret:
          secretName: {{ template "fullname" . }}-webhook-cert
          items:
          - key: tls.crt
            path: tls.crt
          - key: tls.key
            path: tls.key