bundle.yaml

kind: Deployment
apiVersion: apps/v1
metadata:
  name: pull-through-webhook
  namespace: kube-system
spec:
  replicas: 2
  selector:
    matchLabels:
      app: pull-through-webhook
  template:
    metadata:
      labels:
        app: pull-through-webhook
    spec:
      containers:
        - name: pull-through-webhook
          image: ghcr.io/maxtacu/ecr-pull-through:master
          imagePullPolicy: Always
          ports:
            - containerPort: 8443
          volumeMounts:
            - name: tls
              mountPath: "/etc/webhook/certs"
              readOnly: true
            - name: config
              mountPath: "/etc/ecr-pull-through"
              readOnly: true
      volumes:
        - name: tls
          secret:
            secretName: pull-through-tls
        - name: config
          configMap:
            name: pull-through-webhook
---
kind: Service
apiVersion: v1
metadata:
  name: pull-through-webhook
  namespace: kube-system
spec:
  selector:
    app: pull-through-webhook
  ports:
    - port: 443
      targetPort: 8443
---
kind: MutatingWebhookConfiguration
apiVersion: admissionregistration.k8s.io/v1
metadata:
  name: pull-through-webhook
  namespace: kube-system
webhooks:
  - name: pull-through.webhook.dev
    clientConfig:
      caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURXVENDQWtHZ0F3SUJBZ0lVZGlBS2loVEVUd2k0WFFxVWwyTHI5MUNONFZNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1BERUxNQWtHQTFVRUJoTUNRVlV4TFRBckJnTlZCQU1NSkhCMWJHd3RkR2h5YjNWbmFDMTNaV0pvYjI5cgpMbXQxWW1VdGMzbHpkR1Z0TG5OMll6QWVGdzB5TlRBeU1qWXlNelEwTVRsYUZ3MHlOakF5TWpZeU16UTBNVGxhCk1Ed3hDekFKQmdOVkJBWVRBa0ZWTVMwd0t3WURWUVFERENSd2RXeHNMWFJvY205MVoyZ3RkMlZpYUc5dmF5NXIKZFdKbExYTjVjM1JsYlM1emRtTXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDbwpxZERsemdwY1dEWHJ5dXZiVUQweGVnaEZXOUd5blc2dmxqK2JUeXZoR2tDejhkb2N5azBXeGdYWWI1VE9ObWJLCkRRSFVoeVRPU0h1ZGcrWnhpVDBtY3lLTlhLb0NabHNOTTB6a3RJcGMvc2dHN0JoZWx6T0ZIMWlXUytDM3ZsSlYKSTh0czJYUElMajhTb3YwL01Pd05CWU12RkpMTVB4RVZ4REVhbzc5anpySUlBUlova201WkdKUzNhN05BV2JISgp1c1lGa2ZNSTBMakczTzNvdW9NWmtPdndXSXZSM0lRc3E2WHJOVUZPZmppT3ZoSThqTzJmenEydUFHT1JwQXBoCjBsaXdvUzQ2Yng2VVE2YWRqeTA1WXl3SjkwS2szSXZGSGVVcFFaTlFVZ2xUMUVtQXN3ME1kRUdmZW1xTTZUeWIKVmZwMHlvVXRIMnBYd2JFT1k5alhBZ01CQUFHalV6QlJNQjBHQTFVZERnUVdCQlF5WkZVUzQyQ1RjOURzZ054Tgo4dVNFL2dlOHdUQWZCZ05WSFNNRUdEQVdnQlF5WkZVUzQyQ1RjOURzZ054Tjh1U0UvZ2U4d1RBUEJnTlZIUk1CCkFmOEVCVEFEQVFIL01BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ2Z5NFNGYmcvRUJLQnhETjYrNjI1NTZhV3QKMFBTR0FnSDl6ekJpTkR5Z2x6dmdHQThkSlkyZDkxNUdCNzhoSVZRYStEQ2I2RkVvcGFwbUo4RW8xWXBvR3A5QgpRSlRHL2VtWEg0YmVnTXNTYncvWitIZzBHbDhDd2tMNnBWemNaYWROMWJXQ21nMFJPckU5azBJdjRMVlJsVW1KCmYxaXdsaUxvbGg1OFBDcTdsSjUzb0VqanNlVkhhRGkxK1pyN3J2ZGpTUjB6OFlERm9JblNSc1hjS2dIUnZlclYKODNaRCtmZnk4VUdvaWVxM2c4ZERGVWlERnpiK3BSSXkzbUtodHhsdFBjYmpkaWMxVUNFSEEvcDBheUNodjdCOQpUTHVxRFU3cy8raitKMG5tTjdxRUp0OTFnU3JuUlZUOVVGU0Z4WTRMR1M4a1BZUEhTREwvNkV6bFg1eVMKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
      service:
        namespace: kube-system
        name: pull-through-webhook
        path: /mutate
    rules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
        operations: ["CREATE", "UPDATE"]
        scope: Namespaced
    namespaceSelector:
      matchLabels:
        pull-through-enabled: "true" 
    sideEffects: None
    admissionReviewVersions: ["v1"]