apiVersion: v1
kind: ConfigMap
metadata:
  name: admission-controller-config
data:
  config.yaml: |
    inScopeNamespaceSelector:
      exclude:
       - kube-node-lease
       - kube-public
       - kube-storage-version-migrator-operator
       - kube-system
       - open-cluster-management
       - open-cluster-management-hub
       - open-cluster-management-agent
       - open-cluster-management-agent-addon
       - openshift
       - openshift-apiserver
       - openshift-apiserver-operator
       - openshift-authentication
       - openshift-authentication-operator
       - openshift-cloud-credential-operator
       - openshift-cluster-csi-drivers
       - openshift-cluster-machine-approver
       - openshift-cluster-node-tuning-operator
       - openshift-cluster-samples-operator
       - openshift-cluster-storage-operator
       - openshift-cluster-version
       - openshift-compliance
       - openshift-config
       - openshift-config-managed
       - openshift-config-operator
       - openshift-console
       - openshift-console-operator
       - openshift-console-user-settings
       - openshift-controller-manager
       - openshift-controller-manager-operator
       - openshift-dns
       - openshift-dns-operator
       - openshift-etcd
       - openshift-etcd-operator
       - openshift-gatekeeper-system
       - openshift-image-registry
       - openshift-infra
       - openshift-ingress
       - openshift-ingress-canary
       - openshift-ingress-operator
       - openshift-insights
       - openshift-kni-infra
       - openshift-kube-apiserver
       - openshift-kube-apiserver-operator
       - openshift-kube-controller-manager
       - openshift-kube-controller-manager-operator
       - openshift-kube-scheduler
       - openshift-kube-scheduler-operator
       - openshift-kube-storage-version-migrator
       - openshift-kube-storage-version-migrator-operator
       - openshift-kubevirt-infra
       - openshift-machine-api
       - openshift-machine-config-operator
       - openshift-marketplace
       - openshift-monitoring
       - openshift-multus
       - openshift-network-diagnostics
       - openshift-network-operator
       - openshift-node
       - openshift-oauth-apiserver
       - openshift-openstack-infra
       - openshift-operators
       - openshift-operator-lifecycle-manager
       - openshift-ovirt-infra
       - openshift-ovn-kubernetes
       - openshift-sdn
       - openshift-service-ca
       - openshift-service-ca-operator
       - openshift-user-workload-monitoring
       - openshift-vsphere-infra
    allow:
      kinds:
      - kind: Event
      - kind: Lease
      - kind: Endpoints
      - kind: TokenReview
      - kind: SubjectAccessReview
      - kind: SelfSubjectAccessReview
    mode: enforce
    sideEffect: 
      updateMIPStatusForDeniedRequest: true
      createDenyEvent: true