---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: vault-agent-injector-cfg
  labels:
    app.kubernetes.io/name: vault-injector
    app.kubernetes.io/instance: vault
webhooks:
  - name: vault.hashicorp.com
    sideEffects: None
    admissionReviewVersions: ["v1", "v1beta1"]
    timeoutSeconds: 5
    clientConfig:
      service:
        name: vault-agent-injector-svc
        path: "/mutate"
        namespace: hashicorp
        port: 443
      caBundle: ""
    failurePolicy: Fail
    rules:
      - operations: ["CREATE", "UPDATE"]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["deployments", "jobs", "pods", "statefulsets"]
      - operations: ["CREATE", "UPDATE"]
        apiGroups: ["apps.openshift.io"]
        apiVersions: ["v1"]
        resources: ["deploymentConfig"]
    namespaceSelector:
      matchLabels:
          vault.hashicorp.com/agent-webhook: enabled
