---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: kube-webhook-img-rewriter
  annotations:
    cert-manager.io/inject-ca-from: kwir/kube-webhook-img-rewriter-certs
webhooks:
- name: kube-webhook-img-rewriter.kwir.svc
  admissionReviewVersions: ["v1"]
  failurePolicy: Fail
  sideEffects: None
  namespaceSelector:
    matchLabels:
      kwir-podrewriter-enabled: "true"
  clientConfig:
    caBundle: Cg==
    service:
      name: kube-webhook-img-rewriter
      namespace: kwir
      path: /kwir-mutate-v1-pod
  rules:
  - apiGroups: [""]
    apiVersions: ["v1"]
    operations: ["CREATE", "UPDATE"]
    resources: ["pods"]
