1apiVersion: v1
2kind: Pod
3metadata:
4 name: k8s-admission
5 namespace: kube-system
6 labels:
7 run: k8s-admission
8 annotations:
9 prometheus.io/path: /metrics
10 prometheus.io/port: http-metrics
11 prometheus.io/scrape: "true"
12spec:
13 terminationGracePeriodSeconds: 30
14 dnsPolicy: ClusterFirstWithHostNet
15 hostNetwork: true
16 hostname: k8s-admissions-controller
17 initContainers:
18 - name: init-admission-controller-tls-generate
19 image: bzl://cmd/sds/admission/init:container_push
20 command: ["/bin/sh", "/root/generate-tls.sh"]
21 volumeMounts:
22 - name: ca-cert
23 mountPath: /etc/ca/ca.crt
24 - name: ca-key
25 mountPath: /etc/ca/ca.key
26 - name: tls-certs
27 mountPath: /var/certs
28 containers:
29 - name: k8s-admission
30 image: bzl://cmd/sds/admission/controller:container_push
31 args:
32 - run
33 ports:
34 - protocol: TCP
35 containerPort: 8543
36 env:
37 - name: KUBECONFIG
38 value: /root/.kube/config
39 - name: PULLSECRET_NAMESPACE
40 value: external-secrets
41 - name: PULLSECRET_NAME
42 value: edge-docker-pull-secret
43 - name: WEBHOOK_NAME
44 value: admission
45 - name: WEBHOOK_DOMAIN
46 value: edge.ncr.com
47 - name: OLD_WEBHOOK_NAME
48 value: admission-old
49 - name: COSIGN_PUB_KEY
50 value: /data/admission/public-keys/us-east1-docker.pkg.dev/edge-production.crt
51 resources:
52 limits:
53 cpu: "100m"
54 memory: 150Mi
55 requests:
56 cpu: 10m
57 memory: 15Mi
58 volumeMounts:
59 - name: ca-cert
60 mountPath: /ca/ca.crt
61 - name: tls-certs
62 mountPath: /var/certs
63 - name: cosign
64 mountPath: /data/admission/public-keys
65 - name: kubeconfig
66 mountPath: /root/.kube/config
67 - name: etcd-certs
68 mountPath: /etc/kubernetes/pki/etcd/
69 imagePullPolicy: IfNotPresent
70 volumes:
71 - name: ca-cert
72 hostPath:
73 type: File
74 path: /etc/kubernetes/pki/ca.crt
75 - name: ca-key
76 hostPath:
77 type: File
78 path: /etc/kubernetes/pki/ca.key
79 - name: cosign
80 hostPath:
81 type: DirectoryOrCreate
82 path: /data/admission/public-keys
83 - name: etcd-certs
84 hostPath:
85 type: Directory
86 path: /etc/kubernetes/pki/etcd/
87 - name: kubeconfig
88 hostPath:
89 type: File
90 path: /etc/kubernetes/zylevel0.conf
91 - name: tls-certs
92 emptyDir: {}
View as plain text