---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: k8s-workload-registrar
  labels:
    spiffe.io/webhook: "true"
webhooks:
  - name: k8s-workload-registrar.spire.svc
    admissionReviewVersions: ["v1", "v1beta1"]
    clientConfig:
      service:
        name: k8s-workload-registrar
        namespace: spire
        path: "/validate-spiffeid-spiffe-io-v1beta1-spiffeid"
    rules:
    - apiGroups: ["spiffeid.spiffe.io"]
      apiVersions: ["v1beta1"]
      operations: ["CREATE", "UPDATE", "DELETE"]
      resources: ["spiffeids"]
      scope: Namespaced
    sideEffects: None
