validatingwebhookconfiguration.yaml

#@ load("@ytt:data", "data")
#@ load("config.lib.yaml", "name", "fullName", "chart", "labels", "selectorLabels")

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: #@ fullName() + "-validating-webhook-configuration"
  labels: #@ labels()
webhooks:
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
    caBundle: Cg==
    service:
      name: #@ fullName() + "-webhook-service"
      namespace: #@ data.values.release.namespace
      path: /cordoning
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: cordoning.tenant.capsule.clastix.io
  namespaceSelector:
    matchExpressions:
      - key: capsule.clastix.io/tenant
        operator: Exists
  objectSelector: {}
  rules:
    - apiGroups:
        - '*'
      apiVersions:
        - '*'
      operations:
        - CREATE
        - UPDATE
        - DELETE
      resources:
        - '*'
      scope: Namespaced
  sideEffects: None
  timeoutSeconds: #@ data.values.validatingWebhooksTimeoutSeconds
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
    caBundle: Cg==
    service:
      name: #@ fullName() + "-webhook-service"
      namespace: #@ data.values.release.namespace
      path: /ingresses
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: ingress.capsule.clastix.io
  namespaceSelector:
    matchExpressions:
      - key: capsule.clastix.io/tenant
        operator: Exists
  objectSelector: {}
  rules:
    - apiGroups:
        - networking.k8s.io
        - extensions
      apiVersions:
        - v1
        - v1beta1
      operations:
        - CREATE
        - UPDATE
      resources:
        - ingresses
      scope: Namespaced
  sideEffects: None
  timeoutSeconds: #@ data.values.validatingWebhooksTimeoutSeconds
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
    caBundle: Cg==
    service:
      name: #@ fullName() + "-webhook-service"
      namespace: #@ data.values.release.namespace
      path: /namespaces
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: namespaces.capsule.clastix.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
    - apiGroups:
        - ""
      apiVersions:
        - v1
      operations:
        - CREATE
        - UPDATE
        - DELETE
      resources:
        - namespaces
      scope: '*'
  sideEffects: None
  timeoutSeconds: #@ data.values.validatingWebhooksTimeoutSeconds
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
    caBundle: Cg==
    service:
      name: #@ fullName() + "-webhook-service"
      namespace: #@ data.values.release.namespace
      path: /networkpolicies
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: networkpolicies.capsule.clastix.io
  namespaceSelector:
    matchExpressions:
      - key: capsule.clastix.io/tenant
        operator: Exists
  objectSelector: {}
  rules:
    - apiGroups:
        - networking.k8s.io
      apiVersions:
        - v1
      operations:
        - UPDATE
        - DELETE
      resources:
        - networkpolicies
      scope: Namespaced
  sideEffects: None
  timeoutSeconds: #@ data.values.validatingWebhooksTimeoutSeconds
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
    caBundle: Cg==
    service:
      name: #@ fullName() + "-webhook-service"
      namespace: #@ data.values.release.namespace
      path: /pods
      port: 443
  failurePolicy: Fail
  matchPolicy: Exact
  name: pods.capsule.clastix.io
  namespaceSelector:
    matchExpressions:
      - key: capsule.clastix.io/tenant
        operator: Exists
  objectSelector: {}
  rules:
    - apiGroups:
        - ""
      apiVersions:
        - v1
      operations:
        - CREATE
      resources:
        - pods
      scope: Namespaced
  sideEffects: None
  timeoutSeconds: #@ data.values.validatingWebhooksTimeoutSeconds
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
    caBundle: Cg==
    service:
      name: #@ fullName() + "-webhook-service"
      namespace: #@ data.values.release.namespace
      path: /persistentvolumeclaims
  failurePolicy: Fail
  name: pvc.capsule.clastix.io
  namespaceSelector:
    matchExpressions:
      - key: capsule.clastix.io/tenant
        operator: Exists
  objectSelector: {}
  rules:
    - apiGroups:
        - ""
      apiVersions:
        - v1
      operations:
        - CREATE
      resources:
        - persistentvolumeclaims
      scope: Namespaced
  sideEffects: None
  timeoutSeconds: #@ data.values.validatingWebhooksTimeoutSeconds
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
    caBundle: Cg==
    service:
      name: #@ fullName() + "-webhook-service"
      namespace: #@ data.values.release.namespace
      path: /services
      port: 443
  failurePolicy: Fail
  matchPolicy: Exact
  name: services.capsule.clastix.io
  namespaceSelector:
    matchExpressions:
      - key: capsule.clastix.io/tenant
        operator: Exists
  objectSelector: {}
  rules:
    - apiGroups:
        - ""
      apiVersions:
        - v1
      operations:
        - CREATE
        - UPDATE
      resources:
        - services
      scope: Namespaced
  sideEffects: None
  timeoutSeconds: #@ data.values.validatingWebhooksTimeoutSeconds
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
    caBundle: Cg==
    service:
      name: #@ fullName() + "-webhook-service"
      namespace: #@ data.values.release.namespace
      path: /tenants
      port: 443
  failurePolicy: Fail
  matchPolicy: Exact
  name: tenants.capsule.clastix.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
    - apiGroups:
        - capsule.clastix.io
      apiVersions:
        - v1beta1
      operations:
        - CREATE
        - UPDATE
        - DELETE
      resources:
        - tenants
      scope: '*'
  sideEffects: None
  timeoutSeconds: #@ data.values.validatingWebhooksTimeoutSeconds