admission-webhook.yaml

apiVersion: v1
kind: Secret
metadata:
  name: admission-webhook-certs
  namespace: gistpin-system
type: kubernetes.io/tls
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: gistpin-validating-webhook
webhooks:
  - name: validate.gistpin.io
    clientConfig:
      service:
        name: admission-webhook-svc
        namespace: gistpin-system
        path: /validate
    rules:
      - operations: ["CREATE", "UPDATE"]
        apiGroups: ["*"]
        apiVersions: ["*"]
        resources: ["pods", "deployments", "services"]
    failurePolicy: Fail
    admissionReviewVersions: ["v1"]
    sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: gistpin-mutating-webhook
webhooks:
  - name: mutate.gistpin.io
    clientConfig:
      service:
        name: admission-webhook-svc
        namespace: gistpin-system
        path: /mutate
    rules:
      - operations: ["CREATE"]
        apiGroups: ["*"]
        apiVersions: ["*"]
        resources: ["pods"]
    failurePolicy: Fail
    admissionReviewVersions: ["v1"]
    sideEffects: None
---
apiVersion: v1
kind: Service
metadata:
  name: admission-webhook-svc
  namespace: gistpin-system
spec:
  selector:
    app: admission-webhook
  ports:
    - port: 443
      targetPort: 8443
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: admission-webhook
  namespace: gistpin-system
spec:
  replicas: 2
  selector:
    matchLabels:
      app: admission-webhook
  template:
    metadata:
      labels:
        app: admission-webhook
    spec:
      containers:
        - name: webhook
          image: gistpin/admission-webhook:latest
          ports:
            - containerPort: 8443
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: admission-webhook-pdb
  namespace: gistpin-system
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: admission-webhook