---
# Source: cert-manager/templates/webhook-validating-webhook.yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: cert-083-cert-manager-webhook
  labels:
    app: webhook
    app.kubernetes.io/name: webhook
    app.kubernetes.io/instance: cert-083
    app.kubernetes.io/component: "webhook"
    app.kubernetes.io/version: "v1.5.3"
    app.kubernetes.io/managed-by: Helm
    helm.sh/chart: cert-manager-v1.5.3
  annotations:
    cert-manager.io/inject-ca-from-secret: "cert-manager/cert-083-cert-manager-webhook-ca"
webhooks:
  - name: webhook.cert-manager.io
    namespaceSelector:
      matchExpressions:
      - key: "cert-manager.io/disable-validation"
        operator: "NotIn"
        values:
        - "true"
      - key: "name"
        operator: "NotIn"
        values:
        - cert-manager
    rules:
      - apiGroups:
          - "cert-manager.io"
          - "acme.cert-manager.io"
        apiVersions:
          - "v1"
        operations:
          - CREATE
          - UPDATE
        resources:
          - "*/*"
    # We don't actually support `v1beta1` but is listed here as it is a
    # required value for
    # [Kubernetes v1.16](https://github.com/kubernetes/kubernetes/issues/82025).
    # The API server reads the supported versions in order, so _should always_
    # attempt a `v1` request which is understood by the cert-manager webhook.
    # Any `v1beta1` request will return an error and fail closed for that
    # resource (the whole object request is rejected). When we no longer
    # support v1.16 we can remove `v1beta1` from this list.
    admissionReviewVersions: ["v1", "v1beta1"]
    # This webhook only accepts v1 cert-manager resources.
    # Equivalent matchPolicy ensures that non-v1 resource requests are sent to
    # this webhook (after the resources have been converted to v1).
    matchPolicy: Equivalent
    timeoutSeconds: 10
    failurePolicy: Fail
    sideEffects: None
    clientConfig:
      service:
        name: cert-083-cert-manager-webhook
        namespace: "cert-manager"
        path: /validate
