initial import

deploy/certs.yaml

@@ -0,0 +1,27 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: imagepullsecrets-webhook-cert
+  namespace: imagepullsecrets-system
+spec:
+  secretName: imagepullsecrets-webhook-certs
+  duration: 2160h # 90d
+  renewBefore: 360h # 15d
+  subject:
+    organizations:
+      - imagepullsecrets-webhook
+  isCA: false
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS1
+    size: 2048
+  usages:
+    - digital signature
+    - key encipherment
+  dnsNames:
+    - imagepullsecrets-webhook.imagepullsecrets-system.svc
+    - imagepullsecrets-webhook.imagepullsecrets-system.svc.cluster.local
+  issuerRef:
+    name: selfsigned-cluster-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io

deploy/deployment.yaml

@@ -0,0 +1,45 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: imagepullsecrets-webhook
+  namespace: imagepullsecrets-system
+  labels:
+    app: imagepullsecrets-webhook
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: imagepullsecrets-webhook
+  template:
+    metadata:
+      labels:
+        app: imagepullsecrets-webhook
+    spec:
+      serviceAccountName: imagepullsecrets-webhook
+      containers:
+        - name: webhook-server
+          image: imagepullsecrets-webhook
+          imagePullPolicy: Always
+          envFrom:
+            - configMapRef:
+                name: imagepullsecrets-webhook-config
+          env:
+            - name: TLS_CERT_FILE
+              value: "/etc/webhook/certs/tls.crt"
+            - name: TLS_PRIVATE_KEY_FILE
+              value: "/etc/webhook/certs/tls.key"
+          ports:
+            - containerPort: 8443
+          volumeMounts:
+            - name: webhook-certs
+              mountPath: /etc/webhook/certs
+              readOnly: true
+      volumes:
+        - name: webhook-certs
+          secret:
+            secretName: imagepullsecrets-webhook-certs
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+      imagePullSecrets:
+        - name: regcred-harbor

deploy/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- namespace.yaml
+- certs.yaml
+- rbac.yaml
+- deployment.yaml
+- service.yaml
+- mutatingwebhook.yaml
+images:
+  - name: imagepullsecrets-webhook
+    newName: "harbor.cl1.parano.ch/library/imagepullsecrets-webhook@sha256"
+    newTag: "f3c2a78782ebc195305f4766376985d7563a6a107c57b6c62dbf80a7e10c39b7"

deploy/mutatingwebhook.yaml

@@ -0,0 +1,22 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: imagepullsecrets-mutator
+  annotations:
+    cert-manager.io/inject-ca-from: imagepullsecrets-system/imagepullsecrets-webhook-cert
+webhooks:
+- name: imagepullsecrets.imagepullsecrets-system.svc
+  clientConfig:
+    service:
+      name: imagepullsecrets-webhook
+      namespace: imagepullsecrets-system
+      path: "/mutate"
+  rules:
+  - operations: ["CREATE"]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Ignore
+  sideEffects: None
+  admissionReviewVersions: ["v1", "v1beta1"]
+  timeoutSeconds: 5

deploy/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: imagepullsecrets-system

deploy/rbac.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: imagepullsecrets-webhook
+  namespace: imagepullsecrets-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imagepullsecrets-webhook
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "create"]
+- apiGroups: [""]
+  resources: ["namespaces"]
+  verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imagepullsecrets-webhook
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imagepullsecrets-webhook
+subjects:
+- kind: ServiceAccount
+  name: imagepullsecrets-webhook
+  namespace: imagepullsecrets-system

deploy/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: imagepullsecrets-webhook
+  namespace: imagepullsecrets-system
+  labels:
+    app: imagepullsecrets-webhook
+spec:
+  ports:
+    - port: 443
+      targetPort: 8443
+  selector:
+    app: imagepullsecrets-webhook