apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: "{{ namespace }}/kubevirt-virt-api-certs"
  labels:
    app.kubernetes.io/component: kubevirt
    app.kubernetes.io/managed-by: virt-operator
    kubevirt.io: virt-api-mutator
  name: virt-api-mutator
webhooks:
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: virt-api
        namespace: "{{ namespace }}"
        path: /virtualmachines-mutate
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: virtualmachines-mutator.kubevirt.io
    namespaceSelector: {}
    objectSelector: {}
    reinvocationPolicy: Never
    rules:
      - apiGroups:
          - kubevirt.io
        apiVersions:
          - v1alpha3
          - v1
        operations:
          - CREATE
          - UPDATE
        resources:
          - virtualmachines
        scope: '*'
    sideEffects: None
    timeoutSeconds: 10
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: virt-api
        namespace: "{{ namespace }}"
        path: /virtualmachineinstances-mutate
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: virtualmachineinstances-mutator.kubevirt.io
    namespaceSelector: {}
    objectSelector: {}
    reinvocationPolicy: Never
    rules:
      - apiGroups:
          - kubevirt.io
        apiVersions:
          - v1alpha3
          - v1
        operations:
          - CREATE
          - UPDATE
        resources:
          - virtualmachineinstances
        scope: '*'
    sideEffects: None
    timeoutSeconds: 10
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: virt-api
        namespace: "{{ namespace }}"
        path: /migration-mutate-create
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: migrations-mutator.kubevirt.io
    namespaceSelector: {}
    objectSelector: {}
    reinvocationPolicy: Never
    rules:
      - apiGroups:
          - kubevirt.io
        apiVersions:
          - v1alpha3
          - v1
        operations:
          - CREATE
        resources:
          - virtualmachineinstancemigrations
        scope: '*'
    sideEffects: None
    timeoutSeconds: 10
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: virt-api
        namespace: "{{ namespace }}"
        path: /vm-clone-mutate-create
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: virtualmachineclones-mutator.kubevirt.io
    namespaceSelector: {}
    objectSelector: {}
    reinvocationPolicy: Never
    rules:
      - apiGroups:
          - clone.kubevirt.io
        apiVersions:
          - v1alpha1
        operations:
          - CREATE
        resources:
          - virtualmachineclones
        scope: '*'
    sideEffects: None
    timeoutSeconds: 10