webhook.yaml

apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: mutating-webhook-configuration
  namespace: default
  labels:
    app: kustomize-webhook
webhooks:
  - name: kustomize.webhook.com
    clientConfig:
      service:
        name: kustomize-webhook
        namespace: default
        path: /mutate
      caBundle: $TLS_CRT_BASE64
    failurePolicy: Fail
    sideEffects: None
    rules:
    - apiGroups:
      - ""
      apiVersions:
      - "v1"
      operations:
      - "CREATE"
      resources:
      - "pods"
---
apiVersion: v1
kind: Secret
metadata:
  labels:
    app: kustomize-webhook
  name: kustomize-webhook-server-cert
  namespace: default
stringData:
  tls.crt: |-
    $TLS_CRT
  tls.key: |-
    $TLS_KEY
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: kustomize-webhook
  name: kustomize-webhook
  namespace: default
spec:
  ports:
  - name: https
    port: 443
    targetPort: webhook-server
  selector:
    app: kustomize-webhook
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kustomize-webhook
  namespace: default
  labels:
    app: kustomize-webhook
spec:
  selector:
    matchLabels:
      app: kustomize-webhook
  replicas: 1
  template:
    metadata:
      labels:
        app: kustomize-webhook
    spec:
      containers:
      - image: docker.pkg.github.com/sbueringer/kustomize-webhook/webhook:latest
        imagePullPolicy: Always
        args:
        - --patches-glob
        - "/tmp/patches/patch-*.yaml"
        name: webhook
        ports:
        - containerPort: 8443
          name: webhook-server
          protocol: TCP
        - containerPort: 8080
          name: metrics
          protocol: TCP
        volumeMounts:
        - mountPath: /tmp/k8s-webhook-server/serving-certs
          name: cert
          readOnly: true
        - mountPath: /tmp/patches
          name: patches
          readOnly: true
      terminationGracePeriodSeconds: 10
      volumes:
      - name: cert
        secret:
          defaultMode: 420
          secretName: kustomize-webhook-server-cert
      - name: patches
        configMap:
          defaultMode: 420
          name: kustomize-webhook-patches
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: kustomize-webhook-patches
  namespace: default
  labels:
    app: kustomize-webhook
data:
  patch-0.yaml: |-
    apiVersion: v1
    kind: Pod
    metadata:
      name: {{.Name}}
    spec:
      containers:
      - name: sidecar
        image: alpine
        command:
        - tail
        - -f
        - /dev/null