apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: istio-galley
  labels:
    app: galley
    chart: galley
    heritage: Tiller
    release: istio
    istio: galley
webhooks:
  - name: pilot.validation.istio.io
    clientConfig:
      service:
        name: istio-galley
        namespace: istio-system
        path: "/admitpilot"
      caBundle: ""
    rules:
      - operations:
          - CREATE
          - UPDATE
        apiGroups:
          - config.istio.io
        apiVersions:
          - v1alpha2
        resources:
          - httpapispecs
          - httpapispecbindings
          - quotaspecs
          - quotaspecbindings
      - operations:
          - CREATE
          - UPDATE
        apiGroups:
          - security.istio.io
        apiVersions:
          - "*"
        resources:
          - "*"
      - operations:
          - CREATE
          - UPDATE
        apiGroups:
          - authentication.istio.io
        apiVersions:
          - "*"
        resources:
          - "*"
      - operations:
          - CREATE
          - UPDATE
        apiGroups:
          - networking.istio.io
        apiVersions:
          - "*"
        resources:
          - destinationrules
          - envoyfilters
          - gateways
          - serviceentries
          - sidecars
          - virtualservices
    failurePolicy: Fail
    sideEffects: None
    admissionReviewVersions: ["v1", "v1beta1"]
