identityd.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: identityd
  name: identityd
spec:
  replicas: 1
  selector:
    matchLabels:
      app: identityd
  template:
    metadata:
      labels:
        app: identityd
    spec:
      containers:
      - args:
        - run
        - --server
        - /config/system-main.rego
        image: openpolicyagent/opa:0.14.0
        imagePullPolicy: IfNotPresent
        name: opa
        volumeMounts:
        - mountPath: /config
          name: config
          readOnly: true
      - args:
        - --opa-url=http://127.0.0.1:8181/v1
        - --enable-policies=true
        - --replicate-path=kubernetes
        - --replicate=v1/pods
        image: openpolicyagent/kube-mgmt:0.10
        imagePullPolicy: IfNotPresent
        name: mgmt
        lifecycle:
          postStart:
            exec:
              command:
                - sh
                - -c
                - >
                  apk add curl openssl &&
                  echo | openssl s_client -connect kubernetes.default.svc:443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' > /tmp/api-pubkey.pem &&
                  echo {\"cert\"":" \"$(cat /tmp/api-pubkey.pem)\"}  > /tmp/cert.json &&
                  curl "localhost:8181/v1/data/kubernetes/keys" -X PUT -d @/tmp/cert.json
      serviceAccountName: identityd
      volumes:
      - configMap:
          name: identity-validation.rego
        name: config

---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: identityd
  name: identityd

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: identityd
  name: identityd
spec:
  selector:
    app: identityd
  ports:
  - protocol: TCP
    port: 8181
    targetPort: 8181