kubevela/charts/vela-minimal/templates/admission-webhooks/validatingWebhookConfiguration.yaml

{{- if .Values.admissionWebhooks.enabled -}}
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: {{ template "kubevela.fullname" . }}-admission
  namespace: {{ .Release.Namespace }}
  {{- if .Values.admissionWebhooks.certManager.enabled }}
  annotations:
    cert-manager.io/inject-ca-from: {{ printf "%s/%s-root-cert" .Release.Namespace (include "kubevela.fullname" .) | quote }}
  {{- end }}
webhooks:
  {{- if eq .Values.OAMSpecVer "all"}}
  - clientConfig:
      caBundle: Cg==
      service:
        name: {{ template "kubevela.name" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validating-core-oam-dev-v1alpha2-applicationconfigurations
    {{- if .Values.admissionWebhooks.patch.enabled  }}
    failurePolicy: Ignore
    {{- else }}
    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
    {{- end }}
    name: validating.core.oam.dev.v1alpha2.applicationconfigurations
    sideEffects: None
    rules:
      - apiGroups:
          - core.oam.dev
        apiVersions:
          - v1alpha2
        operations:
          - CREATE
          - UPDATE
        resources:
          - applicationconfigurations
        scope: Namespaced
    admissionReviewVersions:
      - v1beta1
      - v1
    timeoutSeconds: 5
  - clientConfig:
      caBundle: Cg==
      service:
        name: {{ template "kubevela.name" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validating-core-oam-dev-v1alpha2-components
    {{- if .Values.admissionWebhooks.patch.enabled  }}
    failurePolicy: Ignore
    {{- else }}
    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
    {{- end }}
    name: validating.core.oam.dev.v1alpha2.components
    sideEffects: None
    rules:
      - apiGroups:
          - core.oam.dev
        apiVersions:
          - v1alpha2
        operations:
          - CREATE
          - UPDATE
        resources:
          - components
        scope: Namespaced
    admissionReviewVersions:
      - v1beta1
      - v1
    timeoutSeconds: 5
  {{- end }}
  - clientConfig:
      caBundle: Cg==
      service:
        name: {{ template "kubevela.name" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validating-core-oam-dev-v1alpha2-traitdefinitions
    {{- if .Values.admissionWebhooks.patch.enabled  }}
    failurePolicy: Ignore
    {{- else }}
    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
    {{- end }}
    name: validating.core.oam.dev.v1alpha2.traitdefinitions
    sideEffects: None
    admissionReviewVersions:
      - v1beta1
      - v1
    rules:
      - apiGroups:
          - core.oam.dev
        apiVersions:
          - v1alpha2
        operations:
          - CREATE
          - UPDATE
        resources:
          - traitdefinitions
        scope: Cluster
    timeoutSeconds: 5
  - clientConfig:
      caBundle: Cg==
      service:
        name: {{ template "kubevela.name" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validate-standard-oam-dev-v1alpha1-podspecworkload
    failurePolicy: Fail
    name: vcontainerized.kb.io
    admissionReviewVersions:
      - v1beta1
      - v1
    sideEffects: None
    rules:
      - apiGroups:
          - standard.oam.dev
        apiVersions:
          - v1alpha1
        operations:
          - CREATE
          - UPDATE
        resources:
          - podspecworkloads
  - clientConfig:
      caBundle: Cg==
      service:
        name: {{ template "kubevela.name" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validating-core-oam-dev-v1beta1-applications
    {{- if .Values.admissionWebhooks.patch.enabled  }}
    failurePolicy: Ignore
    {{- else }}
    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
    {{- end }}
    name: validating.core.oam.dev.v1beta1.applications
    admissionReviewVersions:
      - v1beta1
      - v1
    sideEffects: None
    rules:
      - apiGroups:
          - core.oam.dev
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - applications
  - clientConfig:
      caBundle: Cg==
      service:
        name: {{ template "kubevela.name" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validating-core-oam-dev-v1beta1-componentdefinitions
    {{- if .Values.admissionWebhooks.patch.enabled  }}
    failurePolicy: Ignore
    {{- else }}
    failurePolicy: Fail
    {{- end }}
    name: validating.core.oam-dev.v1beta1.componentdefinitions
    sideEffects: None
    admissionReviewVersions:
      - v1beta1
      - v1
    rules:
      - apiGroups:
          - core.oam.dev
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - componentdefinitions
{{- end -}}