From b6f3fccbea1fd5bdd1c45b68706e24ea7dc1d1f4 Mon Sep 17 00:00:00 2001
From: Dario Tranchitella <dario@tranchitella.eu>
Date: Sat, 12 Jun 2021 09:23:40 +0200
Subject: [PATCH] build(helm): webhook for ImagePullPolicy enforcement

---
 .../validatingwebhookconfiguration.yaml       | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/charts/capsule/templates/validatingwebhookconfiguration.yaml b/charts/capsule/templates/validatingwebhookconfiguration.yaml
index 55567204..1aeb3b95 100644
--- a/charts/capsule/templates/validatingwebhookconfiguration.yaml
+++ b/charts/capsule/templates/validatingwebhookconfiguration.yaml
@@ -5,6 +5,34 @@ metadata:
   labels:
     {{- include "capsule.labels" . | nindent 4 }}
 webhooks:
+- admissionReviewVersions:
+    - v1beta1
+  clientConfig:
+    caBundle: Cg==
+    service:
+      name: {{ include "capsule.fullname" . }}-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /validating-imagepullpolicy
+      port: 443
+  failurePolicy: Fail
+  matchPolicy: Exact
+  name: validating-image-pull-policy.capsule.clastix.io
+  namespaceSelector:
+    matchExpressions:
+      - key: capsule.clastix.io/tenant
+        operator: Exists
+  objectSelector: {}
+  rules:
+    - apiGroups:
+        - ""
+      apiVersions:
+        - v1
+      operations:
+        - CREATE
+      resources:
+        - pods
+  sideEffects: NoneOnDryRun
+  timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
 - admissionReviewVersions:
   - v1beta1
   clientConfig: