cedar-authorization-webhook.yaml

apiVersion: v1
kind: Pod
metadata:
  labels:
    component: cedar-webhook
    tier: control-plane
  name: cedar-webhook
  namespace: kube-system
spec:
  containers:
    - name: cedar-webhook
      command:
        - /cedar-webhook
        - -v=8
        - --config=/cedar-authorizer/cedar-config.yaml
        # - --enable-request-recording=true
        # - --request-recording-dir=/cedar-authorizer/logs/request
      image: cedar-webhook:latest
      imagePullPolicy: IfNotPresent
      env:
        - name: KUBECONFIG
          value: "/cedar-authorizer/policies/cedar-kubeconfig.yaml"
      livenessProbe:
        failureThreshold: 8
        httpGet:
          host: 127.0.0.1
          path: /healthz
          port: 10289
          scheme: HTTP
        initialDelaySeconds: 5
        periodSeconds: 10
        timeoutSeconds: 15
      readinessProbe:
        failureThreshold: 3
        httpGet:
          host: 127.0.0.1
          path: /readyz
          port: 10289
          scheme: HTTP
        periodSeconds: 1
        timeoutSeconds: 15
      startupProbe:
        failureThreshold: 24
        httpGet:
          host: 127.0.0.1
          path: /readyz
          port: 10289
          scheme: HTTP
        initialDelaySeconds: 5
        periodSeconds: 10
        timeoutSeconds: 15
      resources:
        limits:
          cpu: 500m
          memory: 256Mi
        requests:
          cpu: 250m
          memory: 128Mi
      volumeMounts:
        - mountPath: /cedar-authorizer
          name: api-server-cedar-authorizer-files
        - mountPath: /var/run/cedar-authorizer/certs
          name: var-run-cedar-authorizer-certs
        - mountPath: /etc/ssl/certs
          name: ca-certs
          readOnly: true
        - mountPath: /etc/ca-certificates
          name: etc-ca-certificates
          readOnly: true
        - mountPath: /usr/local/share/ca-certificates
          name: usr-local-share-ca-certificates
          readOnly: true
        - mountPath: /usr/share/ca-certificates
          name: usr-share-ca-certificates
          readOnly: true
  hostNetwork: true
  priority: 2000001000
  priorityClassName: system-node-critical
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  volumes:
    - hostPath:
        path: /cedar-authorizer
        type: ""
      name: api-server-cedar-authorizer-files
    - hostPath:
        path: /cedar-authorizer/certs
        type: DirectoryOrCreate
      name: var-run-cedar-authorizer-certs
    - hostPath:
        path: /etc/ssl/certs
        type: DirectoryOrCreate
      name: ca-certs
    - hostPath:
        path: /etc/ca-certificates
        type: DirectoryOrCreate
      name: etc-ca-certificates
    - hostPath:
        path: /usr/local/share/ca-certificates
        type: DirectoryOrCreate
      name: usr-local-share-ca-certificates
    - hostPath:
        path: /usr/share/ca-certificates
        type: DirectoryOrCreate
      name: usr-share-ca-certificates
status: {}