manifest.yaml

---
apiVersion: v1
kind: Service
metadata:
  name: sentry
  namespace: sentry
  labels:
    name: sentry
spec:
  ports:
  - name: webhook
    port: 443
    targetPort: 8080
  selector:
    name: sentry 
---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: sentry
  namespace: sentry
  labels:
    name: sentry
spec:
  replicas: 1
  template:
    metadata:
      name: sentry 
      labels:
        name: sentry
    spec:
      containers:
        - name: webhook
          image: jasonrichardsmith/sentry:${TAG}
          imagePullPolicy: IfNotPresent
          resources:
            limits:
              memory: 500Mi
              cpu: 300m
            requests:
              memory: 500Mi
              cpu: 300m
          volumeMounts:
            - name: webhook-certs
              mountPath: /etc/webhook/certs
              readOnly: true
            - name: config
              mountPath: /config.yaml
              subPath: config.yaml
              readOnly: true
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8080
              scheme: HTTPS
            initialDelaySeconds: 1
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
              scheme: HTTPS
            initialDelaySeconds: 5
            periodSeconds: 10
          securityContext:
            readOnlyRootFilesystem: true
      volumes:
        - name: webhook-certs
          secret:
            secretName: sentry
        - name: config
          configMap:
            name: sentry-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: sentry-config
  labels:
    name: sentry-config
  namespace: sentry
data:
  config.yaml: |
    ---
    limits:
      enabled: true
      ignoredNamespaces:
        - "kube-system"
        - "test2"
        - "test3"
        - "test4"
      cpu:
        min: "0"
        max: "2"
      memory:
        min: "0"
        max: 2G
    healthz:
      enabled: true
      ignoredNamespaces:
        - "kube-system"
        - "test1"
        - "test3"
        - "test4"
    tags:
      enabled: true
      ignoredNamespaces:
        - "kube-system"
        - "test1"
        - "test2" 
        - "test4"
    source:
      enabled: true
      ignoredNamespaces:
        - "kube-system"
        - "test1"
        - "test2" 
        - "test3"
      allowed:
        - "gcr.io"
    example:
      enabled: true
      ignoredNamespaces:
        - "kube-system"
    nslabels:
      enabled: true
      ignoredNamespaces:
        - "kube-system"
        - "test5"
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: sentry
webhooks:
  - name: sentry.jasonrichardsmith.org
    clientConfig:
      service:
        name: sentry
        namespace: sentry
        path: "/"
      caBundle: "${CA_BUNDLE}"
    rules:
      - operations: ["CREATE","UPDATE"]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods", "namespaces"]
    failurePolicy: Ignore