deployment.yaml

---
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: kube-notify
  name: kube-notify
  labels:
    app: kube-notify
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kube-notify
  template:
    metadata:
      labels:
        app: kube-notify
    spec:
      serviceAccountName: kube-notify-watcher
      securityContext:
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        runAsNonRoot: true
      containers:
      - name: kube-notify
        resources:
          requests:
            memory: 500Mi
            cpu: 10m
          limits:
            cpu: 500m
            memory: 1Gi
        image: wikle/kube-notify:v0.3.0
        env:
          - name: REQUESTS_CA_BUNDLE
            value: /etc/ssl/certs/ca-certificates.crt
        # lifecycle:
        #     postStart:
        #       exec:
        #         command:
        #         - /bin/sh
        #         - -c
        #         - wget -O - --no-check-certificate https://mydomain/acr.pem >> /etc/ssl/certs/ca-certificates.crt
        volumeMounts:
        - name: config
          mountPath: /app/config.yaml
          subPath: config.yaml
      volumes:
      - name: config
        configMap:
          name: kube-notify-config

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kube-notify-watcher
  namespace: kube-notify
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  namespace: "*"
  name: kube-notify-watcher
rules:
  - apiGroups: [""]
    resources: ["pods", "events"]
    verbs:  ["get", "watch", "list"]
  - apiGroups: ["velero.io"]
    resources: ["backups", "restores"]
    verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kube-notify-watcher
  namespace: kube-notify
subjects:
  - kind: ServiceAccount
    namespace: kube-notify
    name: kube-notify-watcher
roleRef:
  kind: ClusterRole
  name: kube-notify-watcher
  apiGroup: rbac.authorization.k8s.io