admission-webhook.yaml

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: admission-webhook-k8s
  labels:
    app: admission-webhook-k8s
spec:
  selector:
    matchLabels:
      app: admission-webhook-k8s
  template:
    metadata:
      labels:
        app: admission-webhook-k8s
    spec:
      serviceAccount: admission-webhook-sa
      containers:
        - name: admission-webhook-k8s
          image: ghcr.io/networkservicemesh/cmd-admission-webhook-k8s:v1.11.1
          imagePullPolicy: IfNotPresent
          readinessProbe:
            httpGet:
              path: /ready
              port: 443
              scheme: HTTPS
          env:
            - name: SPIFFE_ENDPOINT_SOCKET
              value: unix:///run/spire/sockets/agent.sock
            - name: NSM_SERVICE_NAME
              value: admission-webhook-svc
            - name: NSM_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: NSM_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: NSM_ANNOTATION
              value: networkservicemesh.io
            - name: NSM_CONTAINER_IMAGES
              value: ghcr.io/networkservicemesh/cmd-nsc:v1.11.1
            - name: NSM_INIT_CONTAINER_IMAGES
              value: ghcr.io/networkservicemesh/cmd-nsc-init:v1.11.1
            - name: NSM_LABELS
              value: spiffe.io/spiffe-id:true
            - name: NSM_ENVS
              value: NSM_LOG_LEVEL=INFO
            - name: NSM_SIDECAR_LIMITS_MEMORY
              value: 80Mi
            - name: NSM_SIDECAR_REQUESTS_MEMORY
              value: 40Mi
            - name: NSM_SIDECAR_LIMITS_CPU
              value: 200m
            - name: NSM_SIDECAR_REQUESTS_CPU
              value: 100m