build(helm): webhook for ImagePullPolicy enforcement

charts/capsule/templates/validatingwebhookconfiguration.yaml

@@ -5,6 +5,34 @@ metadata:
   labels:
     {{- include "capsule.labels" . | nindent 4 }}
 webhooks:
+- admissionReviewVersions:
+    - v1beta1
+  clientConfig:
+    caBundle: Cg==
+    service:
+      name: {{ include "capsule.fullname" . }}-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /validating-imagepullpolicy
+      port: 443
+  failurePolicy: Fail
+  matchPolicy: Exact
+  name: validating-image-pull-policy.capsule.clastix.io
+  namespaceSelector:
+    matchExpressions:
+      - key: capsule.clastix.io/tenant
+        operator: Exists
+  objectSelector: {}
+  rules:
+    - apiGroups:
+        - ""
+      apiVersions:
+        - v1
+      operations:
+        - CREATE
+      resources:
+        - pods
+  sideEffects: NoneOnDryRun
+  timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
 - admissionReviewVersions:
   - v1beta1
   clientConfig: