install.yaml

apiVersion: v1
kind: Secret
metadata:
  name: sigrun-tls
type: Opaque
data:
  tls.crt: {{whCert}}
  tls.key: {{whKey}}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sigrun-account
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: sigrun-account
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["sigrun-controller-config"]
    verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sigrun-account
subjects:
  - kind: ServiceAccount
    name: sigrun-account
    namespace: default
roleRef:
  kind: ClusterRole
  name: sigrun-account
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Service
metadata:
  name: sigrun
  namespace: default
  labels:
    name: sigrun
spec:
  ports:
    - name: sigrun-webhook
      port: 443
      targetPort: 8080
    - name: sigrun-controller
      port: 8000
      targetPort: 8000
  selector:
    name: sigrun
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sigrun
  namespace: default
  labels:
    name: sigrun
spec:
  replicas: 1
  selector:
    matchLabels:
      name: sigrun
  template:
    metadata:
      name: sigrun
      labels:
        name: sigrun
    spec:
      serviceAccountName: sigrun-account
      containers:
        - name: sigrun-controller
          image: ghcr.io/shravanshetty1/sigrun-controller:latest
          imagePullPolicy: IfNotPresent
          volumeMounts:
            - name: webhook-certs
              mountPath: /etc/certs
              readOnly: true
          securityContext:
            readOnlyRootFilesystem: true
      volumes:
        - name: webhook-certs
          secret:
            secretName: sigrun-tls
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: sigrun
webhooks:
  - name: sigrun.default.svc
    clientConfig:
      service:
        name: sigrun
        namespace: default
        path: "/validate"
      caBundle: "{{caCert}}"
    rules:
      - operations: ["CREATE","UPDATE"]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
      - operations: ["CREATE","UPDATE"]
        apiGroups: ["apps"]
        apiVersions: ["v1"]
        resources: ["deployments","daemonsets","replicasets","statefulsets"]
      - operations: ["CREATE","UPDATE"]
        apiGroups: ["batch"]
        apiVersions: ["v1"]
        resources: ["cronjobs","jobs"]
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: sigrun-controller-config
data:
  guid_to_repo_info: ""
  image_to_guids: ""