apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration 
metadata:
  name: image-cloner
webhooks:
  - name: image-cloner.default.svc.cluster.local
    admissionReviewVersions: ["v1"]
    timeoutSeconds: 30
    failurePolicy: Fail
    sideEffects: None
    reinvocationPolicy: IfNeeded
    namespaceSelector:
      matchLabels:
        image-cloner: enabled
    rules:
      - operations: ["CREATE", "UPDATE"]
        apiGroups: ["apps"]
        apiVersions: ["v1"]
        resources: ["deployments", "daemonsets"]
        scope: "Namespaced"
    clientConfig:
      service:
        namespace: "default"
        name: "image-cloner"
        path: "/clone-image"
      caBundle: "${CA_PEM_B64}"

