apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  labels:
    app: admission-webhook
    kustomize.component: admission-webhook
  name: poddefaults.kubeflow.org
spec:
  group: kubeflow.org
  names:
    kind: PodDefault
    plural: poddefaults
    singular: poddefault
  scope: Namespaced
  validation:
    openAPIV3Schema:
      properties:
        apiVersion:
          type: string
        kind:
          type: string
        metadata:
          type: object
        spec:
          properties:
            desc:
              type: string
            env:
              items:
                type: object
              type: array
            envFrom:
              items:
                type: object
              type: array
            selector:
              type: object
            serviceAccountName:
              type: string
            volumeMounts:
              items:
                type: object
              type: array
            volumes:
              items:
                type: object
              type: array
          required:
          - selector
          type: object
        status:
          type: object
      type: object
  version: v1alpha1
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  labels:
    app: admission-webhook
    kustomize.component: admission-webhook
  name: admission-webhook-mutating-webhook-configuration
webhooks:
- clientConfig:
    caBundle: ""
    service:
      name: admission-webhook-service
      namespace: kubeflow
      path: /apply-poddefault
  name: admission-webhook-deployment.kubeflow.org
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: admission-webhook
    kustomize.component: admission-webhook
  name: admission-webhook-service-account
  namespace: kubeflow
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: admission-webhook
    kustomize.component: admission-webhook
  name: admission-webhook-cluster-role
rules:
- apiGroups:
  - kubeflow.org
  resources:
  - poddefaults
  verbs:
  - get
  - watch
  - list
  - update
  - create
  - patch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: admission-webhook
    kustomize.component: admission-webhook
  name: admission-webhook-cluster-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admission-webhook-cluster-role
subjects:
- kind: ServiceAccount
  name: admission-webhook-service-account
  namespace: kubeflow
---
apiVersion: v1
data:
  namespace: kubeflow
kind: ConfigMap
metadata:
  labels:
    app: admission-webhook
    kustomize.component: admission-webhook
  name: admission-webhook-admission-webhook-parameters
  namespace: kubeflow
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: admission-webhook
    kustomize.component: admission-webhook
  name: admission-webhook-service
  namespace: kubeflow
spec:
  ports:
  - port: 443
    targetPort: 443
  selector:
    app: admission-webhook
    kustomize.component: admission-webhook
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: admission-webhook
    kustomize.component: admission-webhook
  name: admission-webhook-deployment
  namespace: kubeflow
spec:
  selector:
    matchLabels:
      app: admission-webhook
      kustomize.component: admission-webhook
  template:
    metadata:
      labels:
        app: admission-webhook
        kustomize.component: admission-webhook
    spec:
      containers:
      - image: gcr.io/kubeflow-images-public/admission-webhook:v20190520-v0-139-gcee39dbc-dirty-0d8f4c
        name: admission-webhook
        volumeMounts:
        - mountPath: /etc/webhook/certs
          name: webhook-cert
          readOnly: true
      serviceAccountName: admission-webhook-service-account
      volumes:
      - name: webhook-cert
        secret:
          secretName: webhook-certs
