apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: spire-controller-manager-webhook
webhooks:
  - admissionReviewVersions: ["v1"]
    clientConfig:
      service:
        name: spire-controller-manager-webhook-service
        namespace: spire-system
        path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
    failurePolicy: Fail
    name: vclusterfederatedtrustdomain.kb.io
    rules:
      - apiGroups: ["spire.spiffe.io"]
        apiVersions: ["v1alpha1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["clusterfederatedtrustdomains"]
    sideEffects: None
  - admissionReviewVersions: ["v1"]
    clientConfig:
      service:
        name: spire-controller-manager-webhook-service
        namespace: spire-system
        path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid
    failurePolicy: Fail
    name: vclusterspiffeid.kb.io
    rules:
      - apiGroups: ["spire.spiffe.io"]
        apiVersions: ["v1alpha1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["clusterspiffeids"]
    sideEffects: None
