checkpoint

.github/workflows/pr.yaml

@@ -512,12 +512,12 @@ jobs:
                   args:
                     - webhook
                   env:
-                    - name: TLS-CERT
+                    - name: TLS_CERT
                       valueFrom:
                         secretKeyRef:
                           name: ziti-webhook-server-cert
                           key: tls.crt
-                    - name: TLS-PRIVATE-KEY
+                    - name: TLS_PRIVATE_KEY
                       valueFrom:
                         secretKeyRef:
                           name: ziti-webhook-server-cert

.gitignore

@@ -25,3 +25,4 @@
 
 # local temp files
 /ziti-agent.yaml
+/ziti-client.yaml

BUILD.md

@@ -7,28 +7,31 @@
 docker build --tag ziti-k8s-agent:local --load .
 ```
 
-## Override the Default Image
+## Load the Image for Local Development
+
+Load the image in your development environment.
+
+### KIND
 
 ```bash
-export ZITI_AGENT_IMAGE=ziti-k8s-agent:local
+kind load docker-image ziti-k8s-agent:local
 ```
 
-## Regenerate the Manifest
+### Minikube
 
 ```bash
-./generate-ziti-webhook-spec.bash
+minikube image load ziti-k8s-agent:local
 ```
 
-## Load the Image for Local Development
-
-### KIND
+## Override the Default Image
 
 ```bash
-kind load docker-image ziti-k8s-agent:local
+export ZITI_AGENT_IMAGE=ziti-k8s-agent:local
+export ZITI_AGENT_IMAGE_PULL_POLICY=Never
 ```
 
-### Minikube
+## Regenerate the Manifest
 
 ```bash
-minikube image load ziti-k8s-agent:local
+./generate-ziti-webhook-spec.bash
 ```

demo/README.md

@@ -3498,12 +3498,12 @@ spec:
         args:
           - webhook
         env:
-          - name: TLS-CERT
+          - name: TLS_CERT
             valueFrom:
               secretKeyRef:
                 name: ziti-webhook-server-cert
                 key: tls.crt
-          - name: TLS-PRIVATE-KEY
+          - name: TLS_PRIVATE_KEY
             valueFrom:
               secretKeyRef:
                 name: ziti-webhook-server-cert

generate-ziti-agent-manifest.bash

@@ -24,7 +24,7 @@ IDENTITY_CERT=$(jq -r '.id.cert' "$IDENTITY_FILE" | sed -E 's/^pem://' | base64
 IDENTITY_KEY=$(jq -r '.id.key' "$IDENTITY_FILE" | sed -E 's/^pem://' | base64 -w0)
 IDENTITY_CA=$(jq -r '.id.ca' "$IDENTITY_FILE" | sed -E 's/^pem://' | base64 -w0)
 
-cat <<YAML > ziti-agent.yaml
+cat <<YAML >| ziti-agent.yaml
 
 ---
 apiVersion: cert-manager.io/v1
@@ -103,18 +103,19 @@ spec:
       containers:
         - name: ziti-admission-webhook
           image: ${ZITI_AGENT_IMAGE:-docker.io/netfoundry/ziti-k8s-agent}
-          imagePullPolicy: IfNotPresent
+          imagePullPolicy: ${ZITI_AGENT_IMAGE_PULL_POLICY:-IfNotPresent}
           ports:
             - containerPort: 9443
-          args:
-            - webhook
+          args: [ "webhook" ]
           env:
-            - name: TLS-CERT
+            - name: ZITI_AGENT_LOG_LEVEL
+              value: ${ZITI_AGENT_LOG_LEVEL:-info}
+            - name: TLS_CERT
               valueFrom:
                 secretKeyRef:
                   name: ziti-webhook-server-cert
                   key: tls.crt
-            - name: TLS-PRIVATE-KEY
+            - name: TLS_PRIVATE_KEY
               valueFrom:
                 secretKeyRef:
                   name: ziti-webhook-server-cert