apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: istio-validator-istio-system
webhooks:
  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
  # are rejecting invalid configs on a per-revision basis.
  - name: rev.validation.istio.io
    admissionReviewVersions: ["v1beta1", "v1"]
    clientConfig:
      # Should change from base but cannot for API compat
      service:
        name: istiod
        namespace: istio-system
        path: "/validate"
    failurePolicy: Ignore
    objectSelector:
      matchExpressions:
        - key: istio.io/rev
          operator: In
          values:
            - "default"
    rules:
      - resources:
          - "*"
        apiGroups:
          - security.istio.io
          - networking.istio.io
          - telemetry.istio.io
          - extensions.istio.io
        apiVersions:
          - "*"
        operations:
          - CREATE
          - UPDATE
    sideEffects: None
