injector-deployment.yaml

# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: MPL-2.0

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vault-injector
  labels:
    app.kubernetes.io/name: vault-injector
    app.kubernetes.io/instance: vault
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: vault-injector
      app.kubernetes.io/instance: vault
  template:
    metadata:
      labels:
        app.kubernetes.io/name: vault-injector
        app.kubernetes.io/instance: vault
    spec:
      serviceAccountName: "vault-injector"
      containers:
        - name: sidecar-injector
          image: "hashicorp/vault-k8s:1.6.0"
          imagePullPolicy: IfNotPresent
          env:
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: AGENT_INJECT_LISTEN
              value: ":8080"
            - name: AGENT_INJECT_LOG_LEVEL
              value: "info"
            - name: AGENT_INJECT_LOG_FORMAT
              value: "standard"
            - name: AGENT_INJECT_VAULT_ADDR
              value: "https://vault.$(NAMESPACE).svc:8200"
            - name: AGENT_INJECT_VAULT_IMAGE
              value: "hashicorp/vault:1.18.2"
            - name: AGENT_INJECT_TLS_AUTO
              value: vault-agent-injector-cfg
            - name: AGENT_INJECT_TLS_AUTO_HOSTS
              value: "vault-agent-injector-svc,vault-agent-injector-svc.$(NAMESPACE),vault-agent-injector-svc.$(NAMESPACE).svc"
            - name: AGENT_INJECT_USE_LEADER_ELECTOR
              value: "true"
            - name: AGENT_INJECT_DEFAULT_TEMPLATE
              value: "map"
            - name: AGENT_INJECT_CPU_REQUEST
              value: "250m"
            - name: AGENT_INJECT_MEM_REQUEST
              value: "64Mi"
            - name: AGENT_INJECT_CPU_LIMIT
              value: "500m"
            - name: AGENT_INJECT_MEM_LIMIT
              value: "128Mi"
          args:
            - agent-inject
            - 2>&1
          livenessProbe:
            httpGet:
              path: /health/ready
              port: 8080
              scheme: HTTPS
            failureThreshold: 2
            initialDelaySeconds: 5
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /health/ready
              port: 8080
              scheme: HTTPS
            failureThreshold: 2
            initialDelaySeconds: 5
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 5