apiVersion: v1
kind: Namespace
metadata:
  name: infra
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: webhook
  namespace: infra
  labels:
    app: webhook
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webhook
  template:
    metadata:
      labels:
        app: webhook
    spec:
      serviceAccountName: webhook-deployer
      containers:
        - name: webhook
          image: almir/webhook:latest
          args:
            - -hooks=/config/hooks.yaml
            - -verbose
            - -port=9000
          ports:
            - containerPort: 9000
              name: http
          securityContext:
            runAsUser: 0
          lifecycle:
            postStart:
              exec:
                command: ["/bin/sh", "-c", "apk add --no-cache git helm sops"]
          env:
            - name: WEBHOOK_SECRET
              valueFrom:
                secretKeyRef:
                  name: webhook-secret
                  key: webhook-secret
            - name: SOPS_AGE_KEY_FILE
              value: /secrets/age.agekey
          volumeMounts:
            - name: hooks-config
              mountPath: /config
            - name: scripts
              mountPath: /scripts
            - name: sops-age
              mountPath: /secrets
              readOnly: true
            - name: repos
              mountPath: /repos
            - name: k3s-config
              mountPath: /etc/rancher/k3s
              readOnly: true
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 128Mi
      volumes:
        - name: hooks-config
          configMap:
            name: webhook-hooks
        - name: scripts
          configMap:
            name: webhook-scripts
            defaultMode: 0755
        - name: sops-age
          secret:
            secretName: sops-age
        - name: repos
          hostPath:
            path: /opt/repos
            type: DirectoryOrCreate
        - name: k3s-config
          hostPath:
            path: /etc/rancher/k3s
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: webhook-deployer
  namespace: infra
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: webhook-deployer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: webhook-deployer
    namespace: infra
---
apiVersion: v1
kind: Service
metadata:
  name: webhook
  namespace: infra
spec:
  type: NodePort
  selector:
    app: webhook
  ports:
    - port: 9000
      targetPort: 9000
      nodePort: 31900
      name: http