apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: capsule
webhooks:
  - name: owner.namespace.capsule.clastix.io
    failurePolicy: Fail
    rules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      operations: ["CREATE"]
      resources: ["namespaces"]
    clientConfig:
      # use url if you're developing locally
      # url: https://<FIXME>.ngrok.io/mutate-v1-namespace-owner-reference
      caBundle:
      service:
        namespace: capsule-system
        name: capsule
        path: /mutate-v1-namespace-owner-reference
  - name: quota.namespace.capsule.clastix.io
    failurePolicy: Fail
    rules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE"]
        resources: ["namespaces"]
    clientConfig:
      # use url if you're developing locally
      # url: https://<FIXME>.ngrok.io/validate-v1-namespace-quota
        caBundle:
        service:
          namespace: capsule-system
          name: capsule
          path: /validate-v1-namespace-quota
  - name: validating.network-policy.capsule.clastix.io
    failurePolicy: Fail
    rules:
    - apiGroups: ["networking.k8s.io"]
      apiVersions: ["v1"]
      operations: ["CREATE", "UPDATE", "DELETE"]
      resources: ["networkpolicies"]
    clientConfig:
      # use url if you're developing locally
      # url: https://<FIXME>.ngrok.io/validating-v1-network-policy
      caBundle:
      service:
        namespace: capsule-system
        name: capsule
        path: /validating-v1-network-policy
  - name: pvc.capsule.clastix.io
    failurePolicy: Fail
    rules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      operations: ["CREATE"]
      resources: ["persistentvolumeclaims"]
    clientConfig:
      # use url if you're developing locally
      # url: https://<FIXME>.ngrok.io/validating-v1-pvc
      caBundle:
      service:
        namespace: capsule-system
        name: capsule
        path: /validating-v1-pvc
  - name: extensions.ingress.capsule.clastix.io
    failurePolicy: Fail
    rules:
      - apiGroups: ["extensions"]
        apiVersions: ["v1beta1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["ingresses"]
    clientConfig:
      # use url if you're developing locally
      # url: https://<FIXME>.ngrok.io/validating-v1-extensions-ingress
      caBundle:
      service:
        namespace: capsule-system
        name: capsule
        path: /validating-v1-extensions-ingress

  - name: networking.ingress.capsule.clastix.io
    failurePolicy: Fail
    rules:
      - apiGroups: ["networking.k8s.io"]
        apiVersions: ["v1beta1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["ingresses"]
    clientConfig:
      # use url if you're developing locally
      # url: https://<FIXME>.ngrok.io/validating-v1-networking-ingress
      caBundle:
      service:
        namespace: capsule-system
        name: capsule
        path: /validating-v1-networking-ingress