apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: imageswap-webhook
  labels:
    app: imageswap
webhooks:
- name: imageswap.ironbank.dso.mil
  clientConfig:
    service:
      name: imageswap
      namespace: imageswap
      path: "/mutate"
    caBundle: ${CA_BUNDLE}
  rules:
  - operations: ["CREATE"]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  sideEffects: None
  objectSelector:
    matchExpressions:
      - key: imageswap.ironbank.dso.mil
        values:
          - "disabled"
        operator: NotIn
  namespaceSelector:
    matchExpressions:
      - key: imageswap.ironbank.dso.mil
        values:
          - "disabled"
        operator: NotIn
  admissionReviewVersions: ["v1"]
  reinvocationPolicy: Never
  timeoutSeconds: 15
