---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: vault
  annotations:
    cert-manager.io/inject-ca-from: theatre-system/theatre-vault-manager
webhooks:
  - admissionReviewVersions: ["v1beta1"] # need to upgrade out webhook to support v1
    clientConfig:
      caBundle: Cg==
      service:
        name: theatre-vault-manager
        namespace: theatre-system
        path: /mutate-pods
        port: 443
    name: envconsul-injector.vault.crd.gocardless.com
    namespaceSelector:
      matchExpressions:
        - key: theatre-envconsul-injector
          operator: In
          values:
            - enabled
    rules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
        resources:
          - pods
        scope: '*'
    sideEffects: None
    timeoutSeconds: 10
