{{- if .Values.webhook.enabled -}} {{- $altNames := list "cmk-webhook-service" ( printf "cmk-webhook-service.%s" .Release.Namespace ) ( printf "cmk-webhook-service.%s.svc" .Release.Namespace ) -}} {{- $cert := genSelfSignedCert ( printf "cmk-webhook-service.%s.svc" .Release.Namespace ) nil $altNames 36500 -}} apiVersion: v1 kind: Secret metadata: name: {{ include "cpu-manager.fullname" . }}-webhook-certs labels: {{- include "cpu-manager.labels" . | nindent 4 }} data: cert.pem: {{ $cert.Cert | b64enc }} key.pem: {{ $cert.Key | b64enc }} type: Opaque --- apiVersion: v1 kind: ConfigMap metadata: name: {{ include "cpu-manager.fullname" . }}-webhook-configmap labels: {{- include "cpu-manager.labels" . | nindent 4 }} data: server.yaml: | server: binding-address: "0.0.0.0" port: {{ .Values.webhook.service.port }} cert: "/etc/ssl/cert.pem" key: "/etc/ssl/key.pem" mutations: "/etc/webhook/mutations.yaml" mutations.yaml: | mutations: perPod: metadata: annotations: cmk.intel.com/resources-injected: "true" spec: serviceAccount: {{ include "cpu-manager.serviceAccountName" . }} tolerations: - operator: Exists volumes: - name: cmk-host-proc hostPath: path: "/proc" - name: cmk-config-dir hostPath: path: {{ .Values.configDir | quote }} - name: cmk-install-dir hostPath: path: {{ .Values.installDir | quote }} perContainer: env: - name: CMK_PROC_FS value: "/host/proc" volumeMounts: - name: cmk-host-proc mountPath: /host/proc readOnly: true - name: cmk-config-dir mountPath: /etc/cmk - name: cmk-install-dir mountPath: /opt/bin --- apiVersion: v1 kind: Service metadata: name: cmk-webhook-service labels: {{- include "cpu-manager.labels" . | nindent 4 }} app: cmk-webhook-app spec: ports: - port: {{ .Values.webhook.service.port }} targetPort: 443 selector: {{- include "cpu-manager.labels" . | nindent 4 }} app: cmk-webhook-app --- apiVersion: apps/v1 kind: Deployment metadata: labels: {{- include "cpu-manager.labels" . | nindent 4 }} app: cmk-webhook-app name: {{ include "cpu-manager.fullname" . }}-webhook-deployment spec: replicas: {{ .Values.webhook.replicaCount }} selector: matchLabels: {{- include "cpu-manager.selectorLabels" . | nindent 6 }} app: cmk-webhook-app template: metadata: labels: {{- include "cpu-manager.selectorLabels" . | nindent 8 }} app: cmk-webhook-app annotations: {{- toYaml .Values.webhook.annotations | nindent 8 }} spec: {{- with .Values.imagePullSecrets }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} tolerations: - operator: "Exists" containers: - args: - "/cmk/cmk.py webhook --conf-file /etc/webhook/server.yaml" command: - "/bin/bash" - "-c" image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} name: cmk-webhook securityContext: {{- toYaml .Values.securityContext | nindent 10 }} volumeMounts: - mountPath: /etc/webhook name: cmk-webhook-configmap - mountPath: /etc/ssl name: cmk-webhook-certs readOnly: True volumes: - name: cmk-webhook-configmap configMap: name: {{ include "cpu-manager.fullname" . }}-webhook-configmap - name: cmk-webhook-certs secret: secretName: {{ include "cpu-manager.fullname" . }}-webhook-certs --- apiVersion: admissionregistration.k8s.io/v1beta1 kind: MutatingWebhookConfiguration metadata: labels: {{- include "cpu-manager.labels" . | nindent 4 }} app: cmk-webhook-app name: {{ include "cpu-manager.fullname" . }}-webhook-config webhooks: - clientConfig: caBundle: {{ $cert.Cert | b64enc }} service: name: cmk-webhook-service namespace: {{ $.Release.Namespace }} path: /mutate failurePolicy: Ignore name: cmk.intel.com rules: - apiGroups: - "" apiVersions: - v1 operations: - CREATE resources: - pods {{- end }}