apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: {{ name }}-validation-webhook
webhooks:
{%- for wh in webhooks %}
  - name: {{ wh.crd_name }}-validation-webhook
    clientConfig:
      service:
        name: {{ name }}-webhook
        namespace: {{ name }}
        path: /{{ wh.api_version }}/{{ wh.singular }}/validate
      caBundle: {{ ca_bundle | default('""') }}
    rules:
      - apiGroups:
          - {{ wh.group }}
        apiVersions:
          - {{ wh.api_version }}
        operations:
        {%- for operation in wh.operations %}
          - {{ operation }}
        {%- endfor %}
        resources:
          - {{ wh.plural }}
        scope: {{ wh.scope }}
    admissionReviewVersions: [ "v1" ]
    sideEffects: None
    failurePolicy: Fail
{%- endfor %}
