---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: k8s-workload-registrar
  labels:
    spiffe.io/webhook: "true"
webhooks:
- name: k8s-workload-registrar.spire.svc
  admissionReviewVersions: ["v1", "v1beta1"]
  clientConfig:
    service:
      name: k8s-workload-registrar
      namespace: spire
      path: "/validate-spiffeid-spiffe-io-v1beta1-spiffeid"
  rules:
  - apiGroups: ["spiffeid.spiffe.io"]
    apiVersions: ["v1beta1"]
    operations: ["CREATE", "UPDATE", "DELETE"]
    resources: ["spiffeids"]
    scope: Namespaced
  sideEffects: None
