40 lines
1.1 KiB
YAML
40 lines
1.1 KiB
YAML
{{- if .Values.global.configValidation }}
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingWebhookConfiguration
|
|
metadata:
|
|
name: istiod-{{ .Values.global.istioNamespace }}
|
|
labels:
|
|
app: istiod
|
|
release: {{ .Release.Name }}
|
|
istio: istiod
|
|
webhooks:
|
|
- name: validation.istio.io
|
|
clientConfig:
|
|
{{- if .Values.base.validationURL }}
|
|
url: {{ .Values.base.validationURL }}
|
|
{{- else }}
|
|
service:
|
|
name: istiod
|
|
namespace: {{ .Values.global.istioNamespace }}
|
|
path: "/validate"
|
|
{{- end }}
|
|
caBundle: "" # patched at runtime when the webhook is ready.
|
|
rules:
|
|
- operations:
|
|
- CREATE
|
|
- UPDATE
|
|
apiGroups:
|
|
- security.istio.io
|
|
- networking.istio.io
|
|
apiVersions:
|
|
- "*"
|
|
resources:
|
|
- "*"
|
|
# Fail open until the validation webhook is ready. The webhook controller
|
|
# will update this to `Fail` and patch in the `caBundle` when the webhook
|
|
# endpoint is ready.
|
|
failurePolicy: Ignore
|
|
sideEffects: None
|
|
admissionReviewVersions: ["v1beta1", "v1"]
|
|
---
|
|
{{- end }} |