apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: default-allow-privilege-escalation
  # labels: {} # managed by kustomize
  annotations:
    cert-manager.io/inject-ca-from: default-allow-privilege-escalation/webhook-server
webhooks:
- name: default-allow-privilege-escalation.webhook.marshallford.me
  failurePolicy: Ignore
  reinvocationPolicy: IfNeeded
  matchPolicy: Equivalent
  sideEffects: None
  timeoutSeconds: 5
  admissionReviewVersions: ["v1"]
  clientConfig:
    service:
      name: webhook
      namespace: default-allow-privilege-escalation
      path: /api/v1/mutate
  rules:
  - operations: ["CREATE", "UPDATE"]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
    scope: Namespaced
  namespaceSelector:
    matchExpressions:
    - key: runlevel
      operator: NotIn
      values: ["0", "1"]
