apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: webhook-test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: default
    namespace: default
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: test-infra-webhook
  name: test-infra-webhook
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test-infra-webhook
  template:
    metadata:
      labels:
        app: test-infra-webhook
    spec:
      containers:
        - image: hub.pingcap.net/qa/test-infra-webhook:latest-amd64
          imagePullPolicy: Never
          name: test-infra-webhook
          env:
            - name: CERT_DIR
              value: "/etc/admission-webhook/tls"
          resources:
            requests:
              cpu: 1000m
              memory: 512Mi
            limits:
              cpu: 1000m
              memory: 512Mi
          volumeMounts:
            - name: tls
              mountPath: "/etc/admission-webhook/tls"
              readOnly: true
      volumes:
        - name: tls
          secret:
            secretName: test-infra-webhook-tls
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: test-infra-webhook
  name: test-infra-webhook
  namespace: default
spec:
  type: NodePort
  ports:
    - port: 443
      protocol: TCP
      targetPort: 443
  selector:
    app: test-infra-webhook