1---
2apiVersion: v1
3kind: Secret
4metadata:
5 name: ambassador-injector-tls
6 namespace: ambassador
7type: Opaque
8data:
9 ## TLS certificate and key for `ambassador-injector.ambassador.svc`
10 crt.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM2VENDQWRFQ0NRREI1M0duaHdlRDREQU5CZ2txaGtpRzl3MEJBUVVGQURCQU1UNHdQQVlEVlFRREREVkIKYldKaGMzTmhaRzl5SUVWa1oyVWdVM1JoWTJzZ1FXUnRhWE56YVc5dUlFTnZiblJ5YjJ4c1pYSWdWMlZpYUc5dgpheUJEUVRBZUZ3MHlNREEwTXpBeE5UVXlNakphRncweU1UQTBNalV4TlRVeU1qSmFNQzB4S3pBcEJnTlZCQU1NCkltRnRZbUZ6YzJGa2IzSXRhVzVxWldOMGIzSXVZVzFpWVhOellXUnZjaTV6ZG1Nd2dnRWlNQTBHQ1NxR1NJYjMKRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFEM2ZIM0dRMjBKU21KZ0lINUZXWHNKVXNvZ3NvUVN0bDVOcUtZeAp2VnRHRkVMTXN5Z1FReWx3aHR6RDlablZiNjNPWWxlWTNzM0NkM1dScnl3T003ZjZ4UUxNaUsrbFF1L3NjQ3pDCnYxVzFUVzNJeTJpR0kxS1U5bXN2TVdDbGpOaUZML0IxRnYrbGgycjN5NHQ3WXJCNGNKcWxWNXdwb1grdjhycEwKd2xxU29ib042Zm1JdlBuZktuZjRFdjhZM0VJSnZWVlk2VXZmTS9haXRvTFQ4bm5PWFpzb1VXR2dHdFY0YlVBUApQbGtEVUhmZE13NitqZC9CbTJpRklrWkNtaytrZzQxdHRwczBRWklqK3piaVJrMmhTeWN1QjVoZVQ0NFhZY2s5CnlKTXVNbVNmU2VQck96N2lmTHk5d2RzalZncS9ZNGVGTDdyMFpncGxCZDlhdkFmMUFnTUJBQUV3RFFZSktvWkkKaHZjTkFRRUZCUUFEZ2dFQkFERlU1UGZtK0RhSW9nMTRUdHZqRUhiS3ZZWld6OVdsTXd5Y1Z5a25ORXVVSUpWRwpFMUJvZE1FUHpZUmR2ajAreTBBY3VaLzUrYnpCdnp3amRuSmhkMklHMmloTm83UlcvY1JkYmJ4cE1HT2d1N0xOCmtXRkR0QlpNeUpES3JmNlIwZzNWcTRNcUdGQk9vblpJSjk0cUYzMlJaNDgyRzMyYlhhNlVHWmVOTUs3SVM4aTEKbUhRdWl5aGRzNDVmMVMwSXMzREtoM2wzQm5NNTlWU0VGVDNkb3NEanhRbG13Q1pOQUhPTk9mNVhtbHhZbDArNgo0ZVhRR0I1cERoUkJ2elhEblNBUWZCWTBpZHNRQWhhTm5Cczc2d1g0VFRkVURobFpReE00RFQzVXcvSkFBMmFMCnlyNDNoYytmZDNKSHlXYTRUeHAwQ2RDTjZ3emlnQTFRK0dtRFpxWT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
11 key.pem: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBOTN4OXhrTnRDVXBpWUNCK1JWbDdDVkxLSUxLRUVyWmVUYWltTWIxYlJoUkN6TE1vCkVFTXBjSWJjdy9XWjFXK3R6bUpYbU43TnduZDFrYThzRGpPMytzVUN6SWl2cFVMdjdIQXN3cjlWdFUxdHlNdG8KaGlOU2xQWnJMekZncFl6WWhTL3dkUmIvcFlkcTk4dUxlMkt3ZUhDYXBWZWNLYUYvci9LNlM4SmFrcUc2RGVuNQppTHo1M3lwMytCTC9HTnhDQ2IxVldPbEwzelAyb3JhQzAvSjV6bDJiS0ZGaG9CclZlRzFBRHo1WkExQjMzVE1PCnZvM2Z3WnRvaFNKR1FwcFBwSU9OYmJhYk5FR1NJL3MyNGtaTm9Vc25MZ2VZWGsrT0YySEpQY2lUTGpKa24wbmoKNnpzKzRueTh2Y0hiSTFZS3YyT0hoUys2OUdZS1pRWGZXcndIOVFJREFRQUJBb0lCQVFERHpPQ05YWWNFbEs4awpNbEQwZVFqWXBZRjVRUU13OHN2RlVTcTdxMzV0QVZhZ01SWC9WOE9QWFlPSUhlV3BjWVBuQnZNYTVSdVJRWVhvCnp0aGlIQlR3OTdGeE5Lc1NhdFQ3RVB5NHp6djJCdDVXd0dkZnlNNXJRRklvc2o0dWZESkpuVlgyclUxeEhxUkkKaStjOHBTWE5BL20xMm95WWUwZFVZd3QxS0wwVHlBWG56dW5zcnZXTGNQam5aNUpFSHlMT3hDTVNOdWZCUzAzYwpmVFlYSEhvYUVIUUk5VmJuUVFFemE1Yk4rSXhxWVpodWZ4dStOa0pjR1lMS3c0Rkg5QU4xWTlQbXBrTEJNMFI0Cm1VZTFqRkJLL2xVK3Bud2xpNlZHOFpsbVRXbnVwVGpYcGt3K3Q4V1dBbE9CTHpucXNhQ3hLRGlIWVR0Q3ludi8KV3lBMFpIeEJBb0dCQVA0TkhzQlJjU0ZDcHI4ZEpDaTdpN3pVZjdGc3NmUUV4RlVlTGNoTWNZelErdUlSUnltLwpJbWgxR1FJeHpOV2d4TzNhMzltNmZHZW1vUld3bGVlclJ1dkZEV1IzU0laV1J5ZHByaFliZk1wSlNiR3V1ODNSCkEzR0RYNWtpUGpPQXlpdW9aZlN0K2ZET3hyNW45ay9vZGxRMkJ0Mm5qdUxYbk5hVkcrZnl1Vys5QW9HQkFQbGkKZXNheElwUXlxbTNRNDFyVERZUXVkazFDMnp1U1FkRVlRTjQyOUJGaWtYMGlWR2c0MnVzTkFKZXRVVTlqNy9YTQoyS1JUZi9RamtjUTRLWVl1WkRXa2paRC8zQWRYYlI5UTEyUWxweGRDYUNKZ3FBbEJlSkswbnNJc2VMVDBWMEFqCms4MW5YRWZ2b1NGN1BISHVlZDU1d1dxQWpSZDgzaEJJdEhBczdVQ1pBb0dBQW1GUkZuQXM1U2pnc3cyczF3emEKeEV3aFhpSXNrS0t5ekRGYU1IUTI1Q0RaR09FY2o1R1Eydld0NUUxZkkrazdyeGJMM2hoWExnbHJuTzVvbVNFTApxdzNQa0U5bHlJeHFZajRsT1dQTWlZQ2lSaDNpK0l5cXdaZC9mOG5JVjJjdmZiVTRMMUNwOU0yYkl4R0tSemxnClVtMm5KdEI1RURzQTV5bkNkeXZZL09rQ2dZQmxPRHRzK2VoM0RqbHVhU0plY3R0Qmt6b2hFY201M0JzcXF4VnAKSEJUa0dZWERySE5sK2UyaENaMzc4alRXYkZHeENudkQ5c0F3YjE5eXJQanRwVmEzRHhzR2gxTGZCL1VhaU0xagpzSVNwUkNMUUVUc2l4cGdSczQzY2NnQnNNZUJZQUJpMWZnWk9qRXh5TW5yT0kyVURqNWVaaXFPNXJNelUveTE5CmVqNnh3UUtCZ0RLUXFsWXFjZ0I5cEEwODFrZVBlRUdXSVVNdXQySkZOeThON2Q4YjBrOEpZejdwUGM2TWx2VWQKd2dGdS9JNDg0YVR5MEhUNTJPQVVmUGNhYmY5b3orNkd0a0dSQ2Q1QVJrSlhtS2huNGN1Z1IyNDJOVi9Sa1RBQwpOU0dtWjZOdGcwdDJLcFg0L00vK2dCWXlOdUxxNzNpQ1B5MUZvcjl5M202NlE5SXpUenlhCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
12---
13apiVersion: admissionregistration.k8s.io/v1
14kind: MutatingWebhookConfiguration
15metadata:
16 name: ambassador-injector-webhook-config
17webhooks:
18 - name: ambassador-injector.getambassador.io
19 clientConfig:
20 service:
21 name: ambassador-injector
22 namespace: ambassador
23 path: "/traffic-agent"
24 caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMvRENDQWVRQ0NRRGc2ZXpnOWthazZEQU5CZ2txaGtpRzl3MEJBUXNGQURCQU1UNHdQQVlEVlFRREREVkIKYldKaGMzTmhaRzl5SUVWa1oyVWdVM1JoWTJzZ1FXUnRhWE56YVc5dUlFTnZiblJ5YjJ4c1pYSWdWMlZpYUc5dgpheUJEUVRBZUZ3MHlNREEwTXpBeE5UVXlNakphRncweU1UQTBNalV4TlRVeU1qSmFNRUF4UGpBOEJnTlZCQU1NCk5VRnRZbUZ6YzJGa2IzSWdSV1JuWlNCVGRHRmpheUJCWkcxcGMzTnBiMjRnUTI5dWRISnZiR3hsY2lCWFpXSm8KYjI5cklFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQTVIelBTeVg2QmxXdApDMjgvMTNFdnl6VFV1QjZiYU1PVHBhM2N5QlVyWlRaeFZqVXJkRGVMTHVUMmNjcW4yM3NobXd4cWpRNFNoTUxOCjZGZWwrQklQc2YwWW40bVg5Rng4M3p5YjY1T1dsQzNHQ2QyTkVFMkpKVGVkQXJxa28wbXFwRVovb09uRTNJbW4Kb0E1V3VQM0NSZHFCekpoQk9iR2N5aGpMNVY3b1ZYL0JtdVFSZlVaRWJXUkp5elpOTVBtUWdyT0lvS2FmWWtRaQpMNG5xTzJzUldQVythUFhkWnJQMjFkYThrZ2U5UWRGZ3JLOG5VVGhzb0l3bFFpOVFVcW5hTURWbzJYTnNwQ2R1CkZQWnVFV25VL1pQQk0vZTNxbDRwQkZxaGJvdWRCNUJWZzE4Um54V0VQZDZWTzJoRmJRQ2c0ekdnZDZlZmIvUkwKeXdrRURsSUpNUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQzh0UTlHNVJqam0zQUFKYVN5NytNTgpBam12Snp0dkoyRVZQd3V0N3ZsV1YvclE5VHp4RnhHa3ZHU0JjRjA2ait1V2NxTktlTHhTeTZNZ21ER0JGKytnCnRYS1VMY0pCanVZZGt6N2Y0QTQ3Yzl4a0Fpckh3c2RnekcwK2R6MHFZOE1ab2x0RmtzRm9JdG1MaVZOYkNucGIKRDZKZlFSc3k0MHc5aVo4Q0RXczhYRU54ZmtxTTNZSlQ0cTFQbWFOTS96eWErblNVTWVyV0tWcFBwb3lyZHhqWApLekZFdFlPL1FwU2ZPa2UwUDN0NW90OEpnSVM3TUd3VzRGMFVub01UNTRCR25KaDBHbmlyWDF4bVZMVE81Sy8wClM5YzZLU2FaK1BoNmFFNzAzenFDZkxvSnY5N1FFS3lVTmE0Y1FBbXAzSWdaNFBNN2dJODFjL3ZGeU1xL3NEYjcKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
25 failurePolicy: Ignore
26 rules:
27 - operations: ["CREATE"]
28 apiGroups: [""]
29 apiVersions: ["v1"]
30 resources: ["pods"]
31---
32apiVersion: apps/v1
33kind: Deployment
34metadata:
35 name: ambassador-injector
36 namespace: ambassador
37spec:
38 replicas: 1
39 selector:
40 matchLabels:
41 app.kubernetes.io/name: ambassador-injector
42 app.kubernetes.io/instance: ambassador
43 template:
44 metadata:
45 labels:
46 app.kubernetes.io/name: ambassador-injector
47 app.kubernetes.io/instance: ambassador
48 annotations:
49 consul.hashicorp.com/connect-inject: 'false'
50 sidecar.istio.io/inject: 'false'
51 spec:
52 containers:
53 - name: webhook
54 image: docker.io/datawire/aes:$version$
55 command: [ "aes-injector" ]
56 env:
57 - name: TRAFFIC_AGENT_IMAGE # Mandatory. The Traffic Agent is included in the AES image.
58 value: docker.io/datawire/aes:$version$
59 - name: TRAFFIC_AGENT_SERVICE_ACCOUNT_NAME # Optional. The Injector can configure the sidecar to use a specific ServiceAccount and service-account-token. if unspecified, the original Pod ServiceAccount is used.
60 value: traffic-agent
61 - name: TRAFFIC_AGENT_AGENT_LISTEN_PORT # Optional. The port on which the Traffic Agent will listen. Defaults to "9900".
62 value: "9900"
63 - name: AGENT_MANAGER_NAMESPACE # Optional. Namespace for contacting the Traffic Manager. Defaults to "ambassador".
64 value: ambassador
65 ports:
66 - containerPort: 8443
67 name: https
68 livenessProbe:
69 httpGet:
70 path: /healthz
71 port: https
72 scheme: HTTPS
73 volumeMounts:
74 - mountPath: /var/run/secrets/tls
75 name: tls
76 readOnly: true
77 volumes:
78 - name: tls
79 secret:
80 secretName: ambassador-injector-tls
81---
82apiVersion: v1
83kind: Service
84metadata:
85 name: ambassador-injector
86 namespace: ambassador
87 annotations:
88 a8r.io/owner: "Ambassador Labs"
89 a8r.io/repository: github.com/datawire/ambassador
90 a8r.io/description: "The Ambassador Edge Stack Service Preview Traffic Agent Sidecar injector."
91 a8r.io/documentation: https://www.getambassador.io/docs/edge-stack/latest/
92 a8r.io/chat: http://a8r.io/Slack
93 a8r.io/bugs: https://github.com/datawire/ambassador/issues
94 a8r.io/support: https://www.getambassador.io/about-us/support/
95 a8r.io/dependencies: "None"
96spec:
97 type: ClusterIP
98 selector:
99 app.kubernetes.io/name: ambassador-injector
100 app.kubernetes.io/instance: ambassador
101 ports:
102 - name: ambassador-injector
103 port: 443
104 targetPort: https
View as plain text