{
  "apiVersion": "admission.k8s.io/v1",
  "kind": "AdmissionReview",
  "request": {
    "uid": "705ab4f5-6393-11e8-b7cc-42010a800002",
    "kind": {
      "group": "apps",
      "version": "v1",
      "kind": "Deployment"
    },
    "resource": {
      "group": "apps",
      "version": "v1",
      "resource": "deployments"
    },
    "requestKind": {
      "group": "apps",
      "version": "v1",
      "kind": "Deployment"
    },
    "requestResource": {
      "group": "apps",
      "version": "v1",
      "resource": "deployments"
    },
    "name": "payment-gateway-service",
    "namespace": "production-fintech",
    "operation": "CREATE",
    "userInfo": {
      "username": "ci-deployer-sa@cluster.local",
      "groups": [
        "system:serviceaccounts",
        "system:serviceaccounts:production-fintech",
        "system:authenticated"
      ]
    },
    "object": {
      "apiVersion": "apps/v1",
      "kind": "Deployment",
      "metadata": {
        "name": "payment-gateway-service",
        "namespace": "production-fintech",
        "labels": {
          "app.kubernetes.io/name": "payment-gateway",
          "app.kubernetes.io/part-of": "checkout-pipeline",
          "tier": "backend",
          "compliance": "pci-dss"
        },
        "annotations": {
          "deployment.kubernetes.io/revision": "1",
          "security.internal/enforce-read-only-root": "true"
        }
      },
      "spec": {
        "replicas": 3,
        "selector": {
          "matchLabels": {
            "app.kubernetes.io/name": "payment-gateway"
          }
        },
        "template": {
          "metadata": {
            "labels": {
              "app.kubernetes.io/name": "payment-gateway",
              "tier": "backend"
            }
          },
          "spec": {
            "serviceAccountName": "payment-processor",
            "automountServiceAccountToken": false,
            "securityContext": {
              "runAsUser": 10001,
              "runAsGroup": 10001,
              "fsGroup": 10001,
              "readOnlyRootFilesystem": true
            },
            "containers": [
              {
                "name": "gateway-api",
                "image": "registry.internal/fintech/payment-gateway:v2.4.1",
                "imagePullPolicy": "IfNotPresent",
                "ports": [
                  {
                    "name": "http-api",
                    "containerPort": 8443,
                    "protocol": "TCP"
                  }
                ],
                "resources": {
                  "requests": {
                    "cpu": "500m",
                    "memory": "512Mi"
                  },
                  "limits": {
                    "cpu": "2000m",
                    "memory": "2Gi"
                  }
                },
                "securityContext": {
                  "allowPrivilegeEscalation": false,
                  "capabilities": {
                    "drop": [
                      "ALL"
                    ]
                  }
                },
                "env": [
                  {
                    "name": "ENVIRONMENT",
                    "value": "production"
                  },
                  {
                    "name": "STRIPE_WEBHOOK_SECRET",
                    "valueFrom": {
                      "secretKeyRef": {
                        "name": "stripe-vault-credentials",
                        "key": "webhook-signing-key"
                      }
                    }
                  }
                ],
                "volumeMounts": [
                  {
                    "name": "tls-certificates",
                    "mountPath": "/etc/ssl/certs/internal",
                    "readOnly": true
                  },
                  {
                    "name": "ephemeral-tmp",
                    "mountPath": "/tmp"
                  }
                ],
                "livenessProbe": {
                  "httpGet": {
                    "path": "/healthz",
                    "port": 8443,
                    "scheme": "HTTPS"
                  },
                  "initialDelaySeconds": 15,
                  "periodSeconds": 10
                }
              }
            ],
            "volumes": [
              {
                "name": "tls-certificates",
                "secret": {
                  "secretName": "payment-gateway-tls-cert"
                }
              },
              {
                "name": "ephemeral-tmp",
                "emptyDir": {}
              }
            ]
          }
        }
      }
    },
    "oldObject": null,
    "dryRun": false
  }
}