apiVersion: v1
kind: Service
metadata:
  name: istio-sidecar-injector
  namespace: {ISTIO_NAMESPACE}
  labels:
    istio: sidecar-injector
spec:
  ports:
  - name: https-webhook # optional
    port: 443
  selector:
    istio: sidecar-injector
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: istio-sidecar-injector-service-account
  namespace: {ISTIO_NAMESPACE}
---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: istio-sidecar-injector
  namespace: {ISTIO_NAMESPACE}
  labels:
    istio: sidecar-injector
spec:
  replicas: 1
  template:
    metadata:
      name: istio-sidecar-injector
      labels:
        istio: sidecar-injector
    spec:
      serviceAccountName: istio-sidecar-injector-service-account
      containers:
        - name: webhook
          image: {PILOT_HUB}/sidecar_injector:{PILOT_TAG}
          imagePullPolicy: IfNotPresent
          args:
            - --tlsCertFile=/etc/istio/certs/cert.pem
            - --tlsKeyFile=/etc/istio/certs/key.pem
            - --injectConfig=/etc/istio/inject/config
            - --meshConfig=/etc/istio/config/mesh
            - --healthCheckInterval=2s
            - --healthCheckFile=/health
          volumeMounts:
          - name: config-volume
            mountPath: /etc/istio/config
            readOnly: true
          - name: certs
            mountPath: /etc/istio/certs
            readOnly: true
          - name: inject-config
            mountPath: /etc/istio/inject
            readOnly: true
          livenessProbe:
            exec:
              command:
                - /usr/local/bin/sidecar-injector
                - probe
                - --probe-path=/health
                - --interval=2s
            initialDelaySeconds: 4
            periodSeconds: 4
          readinessProbe:
            exec:
              command:
                - /usr/local/bin/sidecar-injector
                - probe
                - --probe-path=/health
                - --interval=2s
            initialDelaySeconds: 4
            periodSeconds: 4
      volumes:
      - name: config-volume
        configMap:
          name: istio
      - name: certs
        secret:
          secretName: sidecar-injector-certs
      - name: inject-config
        configMap:
          name: istio-inject
          items:
          - key: config
            path: config
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: istio-sidecar-injector
webhooks:
  - name: sidecar-injector.istio.io
    clientConfig:
      service:
        name: istio-sidecar-injector
        namespace: {ISTIO_NAMESPACE}
        path: "/inject"
      caBundle: ${CA_BUNDLE}
    rules:
      - operations: [ "CREATE" ]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
    failurePolicy: Fail
    namespaceSelector:
      matchLabels:
        istio-injection: enabled
---
