| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117 |
- {{- if .Values.webhook.create }}
- apiVersion: apps/v1
- kind: Deployment
- metadata:
- name: {{ include "external-secrets.fullname" . }}-webhook
- namespace: {{ .Release.Namespace | quote }}
- labels:
- {{- include "external-secrets-webhook.labels" . | nindent 4 }}
- {{- with .Values.webhook.deploymentAnnotations }}
- annotations:
- {{- toYaml . | nindent 4 }}
- {{- end }}
- spec:
- replicas: {{ .Values.webhook.replicaCount }}
- selector:
- matchLabels:
- {{- include "external-secrets-webhook.selectorLabels" . | nindent 6 }}
- template:
- metadata:
- {{- with .Values.webhook.podAnnotations }}
- annotations:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- labels:
- {{- include "external-secrets-webhook.selectorLabels" . | nindent 8 }}
- {{- with .Values.webhook.podLabels }}
- {{- toYaml . | nindent 8 }}
- {{- end }}
- spec:
- {{- with .Values.webhook.imagePullSecrets }}
- imagePullSecrets:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- hostNetwork: {{ .Values.webhook.hostNetwork}}
- serviceAccountName: {{ include "external-secrets-webhook.serviceAccountName" . }}
- automountServiceAccountToken: {{ .Values.webhook.serviceAccount.automount }}
- {{- with .Values.webhook.podSecurityContext }}
- securityContext:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- containers:
- - name: webhook
- {{- with .Values.webhook.securityContext }}
- securityContext:
- {{- toYaml . | nindent 12 }}
- {{- end }}
- image: "{{ .Values.webhook.image.repository }}:{{ .Values.webhook.image.tag | default .Chart.AppVersion }}"
- imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}
- args:
- - webhook
- - --port={{ .Values.webhook.port }}
- - --dns-name={{ include "external-secrets.fullname" . }}-webhook.{{ .Release.Namespace }}.svc
- - --cert-dir={{ .Values.webhook.certDir }}
- - --check-interval={{ .Values.webhook.certCheckInterval }}
- - --metrics-addr=:{{ .Values.webhook.prometheus.service.port }}
- - --healthz-addr={{ .Values.webhook.readinessProbe.address }}:{{ .Values.webhook.readinessProbe.port }}
- {{- if .Values.webhook.lookaheadInterval }}
- - --lookahead-interval={{ .Values.webhook.lookaheadInterval }}
- {{- end }}
- {{- range $key, $value := .Values.webhook.extraArgs }}
- {{- if $value }}
- - --{{ $key }}={{ $value }}
- {{- else }}
- - --{{ $key }}
- {{- end }}
- {{- end }}
- ports:
- - containerPort: {{ .Values.webhook.prometheus.service.port }}
- protocol: TCP
- name: metrics
- - containerPort: {{ .Values.webhook.port }}
- protocol: TCP
- name: webhook
- readinessProbe:
- httpGet:
- port: {{ .Values.webhook.readinessProbe.port }}
- path: /readyz
- initialDelaySeconds: 20
- periodSeconds: 5
- {{- with .Values.webhook.extraEnv }}
- env:
- {{- toYaml . | nindent 12 }}
- {{- end }}
- {{- with .Values.webhook.resources }}
- resources:
- {{- toYaml . | nindent 12 }}
- {{- end }}
- volumeMounts:
- - name: certs
- mountPath: {{ .Values.webhook.certDir }}
- readOnly: true
- {{- if .Values.webhook.extraVolumeMounts }}
- {{- toYaml .Values.webhook.extraVolumeMounts | nindent 12 }}
- {{- end }}
- volumes:
- - name: certs
- secret:
- secretName: {{ include "external-secrets.fullname" . }}-webhook
- {{- if .Values.webhook.extraVolumes }}
- {{- toYaml .Values.webhook.extraVolumes | nindent 8 }}
- {{- end }}
- {{- with .Values.webhook.nodeSelector }}
- nodeSelector:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- {{- with .Values.webhook.affinity }}
- affinity:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- {{- with .Values.webhook.tolerations }}
- tolerations:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- {{- if .Values.webhook.priorityClassName }}
- priorityClassName: {{ .Values.webhook.priorityClassName }}
- {{- end }}
- {{- end }}
|
