apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: trivy-image-validating-webhook-cfg
webhooks:
  - name: trivy-image-validator.devopstales.intra
    sideEffects: "None"
    admissionReviewVersions: [v1beta1, v1]
    clientConfig:
      service:
        name: trivy-image-validator
        namespace: validation
        path: "/validate"
      caBundle: "${CA_BUNDLE}"
    rules:
      - apiGroups: ["apps", ""]
        resources:
          - "deployments"
          - "pods"
        apiVersions:
          - "*"
        operations:
          - CREATE
    namespaceSelector:
      matchLabels:
        trivy-image-validator: enabled
