# Copyright (c) 2020 SIGHUP s.r.l All rights reserved.
# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE file.

---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  labels:
    gatekeeper.sh/system: "yes"
  name: gatekeeper-validating-webhook-configuration
webhooks:
  - admissionReviewVersions:
    - v1
    - v1beta1
    clientConfig:
      caBundle: Cg==
      service:
        name: gatekeeper-webhook-service
        namespace: gatekeeper-system
        path: /v1/admit
    failurePolicy: Ignore
    name: validation.gatekeeper.sh
    namespaceSelector:
      matchExpressions:
        - key: admission.gatekeeper.sh/ignore
          operator: DoesNotExist
    rules:
      - apiGroups:
          - "*"
        apiVersions:
          - "*"
        operations:
          - CREATE
          - UPDATE
        resources:
          - "*"
    sideEffects: None
    timeoutSeconds: 3
  - admissionReviewVersions:
    - v1
    - v1beta1
    clientConfig:
      caBundle: Cg==
      service:
        name: gatekeeper-webhook-service
        namespace: gatekeeper-system
        path: /v1/admitlabel
    failurePolicy: Fail
    name: check-ignore-label.gatekeeper.sh
    rules:
      - apiGroups:
          - ""
        apiVersions:
          - "*"
        operations:
          - CREATE
          - UPDATE
        resources:
          - namespaces
    sideEffects: None
    timeoutSeconds: 3
