apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: hypercloud-mutator
  annotations:
    cert-manager.io/inject-ca-from: hypercloud5-system/hypercloud5-api-server-cert
webhooks:
  - name: hypercloud.mutating.metadata
    clientConfig:
      service:
        name: hypercloud5-api-server-service
        namespace: hypercloud5-system
        path: "/metadata"
        port: 443
      caBundle: Cg==
    rules:
## tmax.io    
      - operations: ["CREATE","UPDATE"]
        apiGroups: ["claim.tmax.io"]
        apiVersions: ["*"]
        resources: ["*"]
      - operations: ["CREATE","UPDATE"]
        apiGroups: ["cluster.tmax.io"]
        apiVersions: ["v1alpha1"]
        resources: ["*"]
      - operations: ["CREATE","UPDATE"]
        apiGroups: ["tmax.io"]
        apiVersions: ["v1"]
        resources: ["*"]
      - operations: ["CREATE","UPDATE"]
        apiGroups: ["credentials.tmax.io"]
        apiVersions: ["v1"]
        resources: ["*"]
      - operations: ["CREATE"]
        apiGroups: ["cicd.tmax.io"]
        apiVersions: ["v1"]
        resources: ["*"]   
      - operations: ["CREATE"]
        apiGroups: ["cicdapi.tmax.io"]
        apiVersions: ["v1"]
        resources: ["*"]     
      - operations: ["CREATE"]
        apiGroups: ["console.tmax.io"]
        apiVersions: ["*"]
        resources: ["*"]    
      - operations: ["CREATE"]
        apiGroups: ["hypercloud.tmaxcloud.com"]
        apiVersions: ["*"]
        resources: ["*"]   
      - operations: ["CREATE"]
        apiGroups: ["registry.tmax.io"]
        apiVersions: ["*"]
        resources: ["*"]         
# k8s      
      - operations: ["CREATE"]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["*"]
      - operations: ["CREATE"]
        apiGroups: ["apps"]
        apiVersions: ["v1"]
        resources: ["*"]
      - operations: ["CREATE"]
        apiGroups: ["batch"]
        apiVersions: ["*"]
        resources: ["*"]  
      - operations: ["CREATE"]
        apiGroups: ["networking.k8s.io"]
        apiVersions: ["*"]
        resources: ["*"]  
      - operations: ["CREATE"]
        apiGroups: ["apiextensions.k8s.io"]
        apiVersions: ["*"]
        resources: ["*"]          
      - operations: ["CREATE"]
        apiGroups: ["rbac.authorization.k8s.io"]
        apiVersions: ["*"]
        resources: ["*"]  
      - operations: ["CREATE"]
        apiGroups: ["policy"]
        apiVersions: ["v1beta1"]
        resources: ["*"]                
      - operations: ["CREATE"]
        apiGroups: ["rbac.authorization.k8s.io"]
        apiVersions: ["*"]
        resources: ["*"]           
      - operations: ["CREATE"]
        apiGroups: ["autoscaling"]
        apiVersions: ["v2beta1"]
        resources: ["*"]            
      - operations: ["CREATE"]
        apiGroups: ["storage.k8s.io"]
        apiVersions: ["v1"]
        resources: ["*"]   
## istio        
      - operations: ["CREATE"]
        apiGroups: ["networking.istio.io"]
        apiVersions: ["*"]
        resources: ["*"]   
      - operations: ["CREATE"]
        apiGroups: ["security.istio.io"]
        apiVersions: ["v1beta1"]
        resources: ["*"]     
      - operations: ["CREATE"]
        apiGroups: ["config.istio.io"]
        apiVersions: ["v1alpha2"]
        resources: ["*"]             
      - operations: ["CREATE"]
        apiGroups: ["authentication.istio.io"]
        apiVersions: ["v1alpha1"]
        resources: ["*"]             
      - operations: ["CREATE"]
        apiGroups: ["rbac.istio.io"]
        apiVersions: ["v1alpha1"]
        resources: ["*"]       
##kubeflow
      - operations: ["CREATE"]
        apiGroups: ["kubeflow.org"]
        apiVersions: ["*"]
        resources: ["*"]     
      - operations: ["CREATE"]
        apiGroups: ["kubeflow.tmax.io"]
        apiVersions: ["*"]
        resources: ["*"]             
      - operations: ["CREATE"]
        apiGroups: ["serving.kubeflow.org"]
        apiVersions: ["*"]
        resources: ["*"] 
## tekton
      - operations: ["CREATE"]
        apiGroups: ["tekton.dev"]
        apiVersions: ["*"]
        resources: ["*"]    
      - operations: ["CREATE"]
        apiGroups: ["triggers.tekton.dev"]
        apiVersions: ["*"]
        resources: ["*"]       
## etc
      - operations: ["CREATE"]
        apiGroups: ["helm.fluxcd.io"]
        apiVersions: ["v1"]
        resources: ["*"]    
      - operations: ["CREATE"]
        apiGroups: ["servicecatalog.k8s.io"]
        apiVersions: ["v1beta1"]
        resources: ["*"]   
      - operations: ["CREATE","UPDATE"]
        apiGroups: ["types.kubefed.io"]
        apiVersions: ["*"]
        resources: ["*"]
      - operations: ["CREATE","UPDATE"]
        apiGroups: ["awx.ansible.com"]
        apiVersions: ["*"]
        resources: ["*"]
    matchPolicy: Equivalent
    sideEffects: None
    admissionReviewVersions: ["v1beta1"]
    timeoutSeconds: 10
    namespaceSelector:
      matchExpressions:
      - key: webhook
        operator: NotIn 
        values: ["false"]
    failurePolicy: Fail
  - name: hypercloud.mutating.inject.pod
    objectSelector:
      matchLabels:
        log-collector: enabled
    clientConfig:
      service:
        name: hypercloud5-api-server-service
        namespace: hypercloud5-system
        path: "/inject/pod"
        port: 443
      caBundle: Cg==
    rules:
      - operations: ["CREATE"]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
    matchPolicy: Equivalent
    sideEffects: None
    admissionReviewVersions: ["v1beta1"]
    timeoutSeconds: 10
    failurePolicy: Fail
  - name: hypercloud.mutating.inject.deployment
    objectSelector:
      matchLabels:
        log-collector: enabled
    clientConfig:
      service:
        name: hypercloud5-api-server-service
        namespace: hypercloud5-system
        path: "/inject/deployment"
        port: 443
      caBundle: Cg==
    rules:
      - operations: ["CREATE"]
        apiGroups: ["apps"]
        apiVersions: ["v1"]
        resources: ["deployments"]
    matchPolicy: Equivalent
    sideEffects: None
    admissionReviewVersions: ["v1beta1"]
    timeoutSeconds: 10
    failurePolicy: Fail
  - name: hypercloud.mutating.inject.replicaset
    objectSelector:
      matchLabels:
        log-collector: enabled  
    clientConfig:
      service:
        name: hypercloud5-api-server-service
        namespace: hypercloud5-system
        path: "/inject/replicaset"
        port: 443
      caBundle: Cg==
    rules:
      - operations: ["CREATE"]
        apiGroups: ["apps"]
        apiVersions: ["v1"]
        resources: ["replicasets"]
    matchPolicy: Equivalent
    sideEffects: None
    admissionReviewVersions: ["v1beta1"]
    timeoutSeconds: 10
    failurePolicy: Fail
  - name: hypercloud.mutating.inject.statefulset
    objectSelector:
      matchLabels:
        log-collector: enabled  
    clientConfig:
      service:
        name: hypercloud5-api-server-service
        namespace: hypercloud5-system
        path: "/inject/statefulset"
        port: 443
      caBundle: Cg==
    rules:
      - operations: ["CREATE"]
        apiGroups: ["apps"]
        apiVersions: ["v1"]
        resources: ["statefulsets"]
    matchPolicy: Equivalent
    sideEffects: None
    admissionReviewVersions: ["v1beta1"]
    timeoutSeconds: 10
    failurePolicy: Fail
  - name: hypercloud.mutating.inject.daemonset
    objectSelector:
      matchLabels:
        log-collector: enabled  
    clientConfig:
      service:
        name: hypercloud5-api-server-service
        namespace: hypercloud5-system
        path: "/inject/daemonset"
        port: 443
      caBundle: Cg==
    rules:
      - operations: ["CREATE"]
        apiGroups: ["apps"]
        apiVersions: ["v1"]
        resources: ["daemonsets"]
    matchPolicy: Equivalent
    sideEffects: None
    admissionReviewVersions: ["v1beta1"]
    timeoutSeconds: 10
    failurePolicy: Fail
  - name: hypercloud.mutating.inject.cronjob
    objectSelector:
      matchLabels:
        log-collector: enabled  
    clientConfig:
      service:
        name: hypercloud5-api-server-service
        namespace: hypercloud5-system
        path: "/inject/cronjob"
        port: 443
      caBundle: Cg==
    rules:
      - operations: ["CREATE"]
        apiGroups: ["batch"]
        apiVersions: ["v1"]
        resources: ["cronjobs"]
    matchPolicy: Equivalent
    sideEffects: None
    admissionReviewVersions: ["v1beta1"]
    timeoutSeconds: 10
    failurePolicy: Fail
  - name: hypercloud.mutating.inject.job
    objectSelector:
      matchLabels:
        log-collector: enabled  
    clientConfig:
      service:
        name: hypercloud5-api-server-service
        namespace: hypercloud5-system
        path: "/inject/job"
        port: 443
      caBundle: Cg==
    rules:
      - operations: ["CREATE"]
        apiGroups: ["batch"]
        apiVersions: ["v1"]
        resources: ["jobs"]
    matchPolicy: Equivalent
    sideEffects: None
    admissionReviewVersions: ["v1beta1"]
    timeoutSeconds: 10
    failurePolicy: Fail