iframe-proxy | Sunbelt Computer Software

This repository was archived by the owner on Sep 23, 2025. It is now read-only.

Repository navigation

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

---

apiVersion: apps/v1

kind: Deployment

metadata:

name: webhook

namespace: cosign-system

spec:

selector:

matchLabels:

role: webhook

template:

metadata:

labels:

role: webhook

spec:

# To avoid node becoming SPOF, spread our replicas to different nodes.

affinity:

podAntiAffinity:

preferredDuringSchedulingIgnoredDuringExecution:

- podAffinityTerm:

labelSelector:

matchLabels:

role: webhook

topologyKey: kubernetes.io/hostname

weight: 100

serviceAccountName: webhook

containers:

- name: webhook

# This is the Go import path for the binary that is containerized

# and substituted here.

image: ko://github.com/sigstore/policy-controller/cmd/webhook

args: [

# Uncomment these to initialize with a custom TUF root.

# TODO: How to specify the entire TUF directory for multiple

# TUF roots.

#"--tuf-mirror", "http://tuf.tuf-system.svc",

#"--tuf-root", "/var/run/tuf/root.json",

# Uncomment to customize ClusterImagePolicy resync period

# "--policy-resync-period", "10h",

]

resources:

requests:

cpu: 40m

memory: 40Mi

limits:

cpu: 400m

memory: 400Mi

env:

- name: SYSTEM_NAMESPACE

valueFrom:

fieldRef:

fieldPath: metadata.namespace

- name: CONFIG_LOGGING_NAME

value: config-logging

- name: METRICS_DOMAIN

value: sigstore.dev/policy

- name: WEBHOOK_NAME

value: webhook

- name: KUBERNETES_MIN_VERSION

value: "1.21.0"

- name: HOME

value: "/var/run/sigstore"

securityContext:

allowPrivilegeEscalation: false

readOnlyRootFilesystem: true

runAsNonRoot: true

capabilities:

drop:

- ALL

volumeMounts:

- name: homedir

mountPath: "/var/run/sigstore"

- name: tuf-root

mountPath: "/var/run/tuf"

readOnly: true

readinessProbe: &probe

failureThreshold: 6

initialDelaySeconds: 20

periodSeconds: 1

httpGet:

scheme: HTTPS

port: 8443

httpHeaders:

- name: k-kubelet-probe

value: "webhook"

livenessProbe: *probe

# Our webhook should gracefully terminate by lame ducking first, set this to a sufficiently

# high value that we respect whatever value it has configured for the lame duck grace period.

terminationGracePeriodSeconds: 300

volumes:

- emptyDir: {}

name: homedir

- name: tuf-root

secret:

secretName: tuf-root

# This is marked as optional, since if you are using public

# instance, TUF root is built in to the cosign container.

optional: true

items:

- key: root

path: root.json

---

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

webhook.yaml

webhook.yaml

Sunbelt Computer Software

PL/B Language Development and Support

FilesExpand file tree

webhook.yaml

Latest commit

History

webhook.yaml

File metadata and controls