apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: "cache.wtcx.dev"
  annotations:
    cert-manager.io/inject-ca-from: default/wtcx-admission-webhook-crt
webhooks:
  - name: "validating.cache.wtcx.dev"
    admissionReviewVersions: ["v1"]
    timeoutSeconds: 2
    sideEffects: "None"
    failurePolicy: "Fail"
    matchPolicy: Equivalent
    objectSelector:
      matchExpressions:
        - key: cache.wtcx.dev/inject
          operator: NotIn
          values:
            - "disabled"
    namespaceSelector:
      matchExpressions:
        - key: "cache.wtcx.dev/inject"
          operator: NotIn
          values:
            - "disabled"
    rules:
      - operations: ["CREATE"]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
        scope: "Namespaced"
    clientConfig:
      service:
        namespace: "default"
        name: "wtcx-admission-webhook"
        path: "/v1/hook/cache/validate"
        port: 443
