Skip to content

Commit 899b4d0

Browse files
author
github-actions
committed
Update image version in manifest to v0.1.6
1 parent b66951f commit 899b4d0

12 files changed

+190
-217
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ the container image. You can use digester to deploy container images by digest.
5757
Alternatively, you can download the latest version using these commands:
5858
5959
```sh
60-
VERSION=v0.1.5
60+
VERSION=v0.1.6
6161
curl -Lo digester "https://github.com/google/k8s-digester/releases/download/${VERSION}/digester_$(uname -s)_$(uname -m)"
6262
chmod +x digester
6363
```

‎manifests/Kptfile‎

Lines changed: 2 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,8 @@
1-
# Copyright 2021 Google LLC
2-
#
3-
# Licensed under the Apache License, Version 2.0 (the "License");
4-
# you may not use this file except in compliance with the License.
5-
# You may obtain a copy of the License at
6-
#
7-
# http://www.apache.org/licenses/LICENSE-2.0
8-
#
9-
# Unless required by applicable law or agreed to in writing, software
10-
# distributed under the License is distributed on an "AS IS" BASIS,
11-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12-
# See the License for the specific language governing permissions and
13-
# limitations under the License.
14-
151
apiVersion: kpt.dev/v1
162
kind: Kptfile
173
metadata:
184
name: digester
195
annotations:
20-
config.kubernetes.io/local-config: 'true'
6+
config.kubernetes.io/local-config: "true"
217
info:
22-
description: >-
23-
The digester mutating admission webhook resolves tags to digests for
24-
container and init container images in Kubernetes Pod and Pod template
25-
specs.
8+
description: The digester mutating admission webhook resolves tags to digests for container and init container images in Kubernetes Pod and Pod template specs.

‎manifests/cluster-role-binding.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
14-
1514
apiVersion: rbac.authorization.k8s.io/v1
1615
kind: ClusterRoleBinding
1716
metadata:
@@ -23,6 +22,6 @@ roleRef:
2322
kind: ClusterRole
2423
apiGroup: rbac.authorization.k8s.io
2524
subjects:
26-
- name: digester-admin
27-
namespace: digester-system
28-
kind: ServiceAccount
25+
- name: digester-admin
26+
namespace: digester-system
27+
kind: ServiceAccount

‎manifests/cluster-role.yaml‎

Lines changed: 39 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -11,50 +11,49 @@
1111
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
14-
1514
apiVersion: rbac.authorization.k8s.io/v1
1615
kind: ClusterRole
1716
metadata:
1817
name: digester-manager-role
1918
labels:
2019
digester/system: 'yes'
2120
rules:
22-
- resources:
23-
- secrets # access to imagePullSecrets
24-
- serviceaccounts # access to imagepullSecrets
25-
apiGroups:
26-
- ''
27-
verbs:
28-
- get
29-
- list
30-
- watch
31-
- resources:
32-
- customresourcedefinitions
33-
apiGroups:
34-
- apiextensions.k8s.io
35-
verbs:
36-
- get
37-
- list
38-
- watch
39-
- resources:
40-
- mutatingwebhookconfigurations
41-
apiGroups:
42-
- admissionregistration.k8s.io
43-
verbs:
44-
- get
45-
- list
46-
- watch
47-
- resources:
48-
- mutatingwebhookconfigurations
49-
apiGroups:
50-
- admissionregistration.k8s.io
51-
resourceNames:
52-
- digester-mutating-webhook-configuration
53-
verbs:
54-
- create
55-
- delete
56-
- get
57-
- list
58-
- patch
59-
- update
60-
- watch
21+
- resources:
22+
- secrets # access to imagePullSecrets
23+
- serviceaccounts # access to imagepullSecrets
24+
apiGroups:
25+
- ''
26+
verbs:
27+
- get
28+
- list
29+
- watch
30+
- resources:
31+
- customresourcedefinitions
32+
apiGroups:
33+
- apiextensions.k8s.io
34+
verbs:
35+
- get
36+
- list
37+
- watch
38+
- resources:
39+
- mutatingwebhookconfigurations
40+
apiGroups:
41+
- admissionregistration.k8s.io
42+
verbs:
43+
- get
44+
- list
45+
- watch
46+
- resources:
47+
- mutatingwebhookconfigurations
48+
apiGroups:
49+
- admissionregistration.k8s.io
50+
resourceNames:
51+
- digester-mutating-webhook-configuration
52+
verbs:
53+
- create
54+
- delete
55+
- get
56+
- list
57+
- patch
58+
- update
59+
- watch

‎manifests/deployment.yaml‎

Lines changed: 63 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
14-
1514
apiVersion: apps/v1
1615
kind: Deployment
1716
metadata:
@@ -42,67 +41,67 @@ spec:
4241
nodeSelector:
4342
kubernetes.io/os: linux
4443
containers:
45-
- name: manager
46-
image: ko://github.com/google/k8s-digester # kpt-set: ${image}
47-
args:
48-
- webhook
49-
- --cert-dir=/certs # kpt-set: --cert-dir=${cert-dir}
50-
- --disable-cert-rotation=false # kpt-set: --disable-cert-rotation=${disable-cert-rotation}
51-
- --dry-run=false # kpt-set: --dry-run=${dry-run}
52-
- --health-addr=:9090 # kpt-set: --health-addr=:${health-port}
53-
- --metrics-addr=:8888 # kpt-set: --metrics-addr=:${metrics-port}
54-
- --offline=false # kpt-set: --offline=${offline}
55-
- --port=8443 # kpt-set: --port=${port}
56-
ports:
57-
- name: webhook-server
58-
protocol: TCP
59-
containerPort: 8443 # kpt-set: ${port}
60-
- name: metrics
61-
protocol: TCP
62-
containerPort: 8888 # kpt-set: ${metrics-port}
63-
- name: healthz
64-
protocol: TCP
65-
containerPort: 9090 # kpt-set: ${health-port}
66-
env:
67-
- name: DEBUG
68-
value: 'false' # kpt-set: ${debug}
69-
- name: POD_NAME
70-
valueFrom:
71-
fieldRef:
72-
fieldPath: metadata.name
73-
- name: POD_NAMESPACE
74-
valueFrom:
75-
fieldRef:
76-
apiVersion: v1
77-
fieldPath: metadata.namespace
78-
resources:
79-
requests:
80-
cpu: 100m # kpt-set: ${request-cpu}
81-
ephemeral-storage: 256Mi # kpt-set: ${request-ephemeral-storage}
82-
memory: 256Mi # kpt-set: ${request-memory}
83-
volumeMounts:
84-
- name: cert
85-
readOnly: true
86-
mountPath: /certs # kpt-set: ${cert-dir}
87-
livenessProbe:
88-
httpGet:
89-
port: healthz
90-
path: /healthz
91-
readinessProbe:
92-
httpGet:
93-
port: healthz
94-
path: /readyz
95-
securityContext:
96-
allowPrivilegeEscalation: false
97-
capabilities:
98-
drop:
99-
- all
100-
readOnlyRootFilesystem: true
101-
runAsGroup: 65532
102-
runAsNonRoot: true
103-
runAsUser: 65532
44+
- name: manager
45+
image: ghcr.io/google/k8s-digester:v0.1.6@sha256:5a8e9b25b7464b550c959937c412b1451004ff8d426b23ea5e8f31a5cc497a4d # kpt-set: ${image}
46+
args:
47+
- webhook
48+
- --cert-dir=/certs # kpt-set: --cert-dir=${cert-dir}
49+
- --disable-cert-rotation=false # kpt-set: --disable-cert-rotation=${disable-cert-rotation}
50+
- --dry-run=false # kpt-set: --dry-run=${dry-run}
51+
- --health-addr=:9090 # kpt-set: --health-addr=:${health-port}
52+
- --metrics-addr=:8888 # kpt-set: --metrics-addr=:${metrics-port}
53+
- --offline=false # kpt-set: --offline=${offline}
54+
- --port=8443 # kpt-set: --port=${port}
55+
ports:
56+
- name: webhook-server
57+
protocol: TCP
58+
containerPort: 8443 # kpt-set: ${port}
59+
- name: metrics
60+
protocol: TCP
61+
containerPort: 8888 # kpt-set: ${metrics-port}
62+
- name: healthz
63+
protocol: TCP
64+
containerPort: 9090 # kpt-set: ${health-port}
65+
env:
66+
- name: DEBUG
67+
value: 'false' # kpt-set: ${debug}
68+
- name: POD_NAME
69+
valueFrom:
70+
fieldRef:
71+
fieldPath: metadata.name
72+
- name: POD_NAMESPACE
73+
valueFrom:
74+
fieldRef:
75+
apiVersion: v1
76+
fieldPath: metadata.namespace
77+
resources:
78+
requests:
79+
cpu: 100m # kpt-set: ${request-cpu}
80+
ephemeral-storage: 256Mi # kpt-set: ${request-ephemeral-storage}
81+
memory: 256Mi # kpt-set: ${request-memory}
82+
volumeMounts:
83+
- name: cert
84+
readOnly: true
85+
mountPath: /certs # kpt-set: ${cert-dir}
86+
livenessProbe:
87+
httpGet:
88+
port: healthz
89+
path: /healthz
90+
readinessProbe:
91+
httpGet:
92+
port: healthz
93+
path: /readyz
94+
securityContext:
95+
allowPrivilegeEscalation: false
96+
capabilities:
97+
drop:
98+
- all
99+
readOnlyRootFilesystem: true
100+
runAsGroup: 65532
101+
runAsNonRoot: true
102+
runAsUser: 65532
104103
volumes:
105-
- name: cert
106-
secret:
107-
defaultMode: 420
108-
secretName: digester-webhook-server-cert
104+
- name: cert
105+
secret:
106+
defaultMode: 420
107+
secretName: digester-webhook-server-cert

0 commit comments

Comments
 (0)