apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment
spec:
  template:
    metadata:
      labels:
        sidecar.istio.io/inject: "false"
    spec:
      containers:
      - image: ghcr.io/kubeflow/kubeflow/poddefaults-webhook
        name: admission-webhook
        volumeMounts:
        - mountPath: /etc/webhook/certs
          name: webhook-cert
          readOnly: true
        ports:
        - name: https-webhook
          containerPort: 4443
      volumes:
      - name: webhook-cert
        secret:
          secretName: webhook-certs
      serviceAccountName: service-account