apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: istio-sidecar-injector
webhooks:
  - name: rev.namespace.sidecar-injector.istio.io
    admissionReviewVersions: ["v1beta1", "v1"]
    clientConfig:
      service:
        name: istiod
        namespace: istio-system
        port: 443
        path: "/inject"
    failurePolicy: Fail
    namespaceSelector:
      matchExpressions:
        - key: istio.io/rev
          operator: In
          values:
            - "default"
        - key: istio-injection
          operator: DoesNotExist
    objectSelector:
      matchExpressions:
        - key: sidecar.istio.io/inject
          operator: NotIn
          values:
            - "false"
    rules:
      - resources: ["pods"]
        apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE"]
    sideEffects: None
  - name: rev.object.sidecar-injector.istio.io
    admissionReviewVersions: ["v1beta1", "v1"]
    clientConfig:
      service:
        name: istiod
        namespace: istio-system
        port: 443
        path: "/inject"
    failurePolicy: Fail
    namespaceSelector:
      matchExpressions:
        - key: istio.io/rev
          operator: DoesNotExist
        - key: istio-injection
          operator: DoesNotExist
    objectSelector:
      matchExpressions:
        - key: sidecar.istio.io/inject
          operator: NotIn
          values:
            - "false"
        - key: istio.io/rev
          operator: In
          values:
            - "default"
    rules:
      - resources: ["pods"]
        apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE"]
    sideEffects: None
  - name: namespace.sidecar-injector.istio.io
    admissionReviewVersions: ["v1beta1", "v1"]
    clientConfig:
      service:
        name: istiod
        namespace: istio-system
        port: 443
        path: "/inject"
    failurePolicy: Fail
    namespaceSelector:
      matchExpressions:
        - key: istio-injection
          operator: In
          values:
            - enabled
    objectSelector:
      matchExpressions:
        - key: sidecar.istio.io/inject
          operator: NotIn
          values:
            - "false"
    rules:
      - resources: ["pods"]
        apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE"]
    sideEffects: None
  - name: object.sidecar-injector.istio.io
    admissionReviewVersions: ["v1beta1", "v1"]
    clientConfig:
      service:
        name: istiod
        namespace: istio-system
        port: 443
        path: "/inject"
    failurePolicy: Fail
    namespaceSelector:
      matchExpressions:
        - key: istio-injection
          operator: DoesNotExist
        - key: istio.io/rev
          operator: DoesNotExist
    objectSelector:
      matchExpressions:
        - key: sidecar.istio.io/inject
          operator: In
          values:
            - "true"
        - key: istio.io/rev
          operator: DoesNotExist
    rules:
      - resources: ["pods"]
        apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE"]
    sideEffects: None
