{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
{{- if not .Values.global.operatorManageWebhooks }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
{{- if eq .Release.Namespace "istio-system"}}
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
{{- else }}

    protoPackage: "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"

  - kind: "MutatingWebhookConfiguration"
    plural: "mutatingwebhookconfigurations"
    group: "admissionregistration.k8s.io"
    version: "v1"
    clusterScoped: true
    builtin: true
    specless: true
    proto: "k8s.io.api.admissionregistration.v1.MutatingWebhookConfiguration"
    protoPackage: "k8s.io/api/admissionregistration/v1"

		"testdata/check-inject/rev-16-injector.yaml",
		"testdata/check-inject/never-match-injector.yaml",
	}
	var whs []admitv1.MutatingWebhookConfiguration
	for _, whName := range whFiles {
		file, err := os.ReadFile(whName)
		if err != nil {
			t.Fatal(err)
		}
		var wh *admitv1.MutatingWebhookConfiguration
		if err := yaml.Unmarshal(file, &wh); err != nil {
			t.Fatal(err)
		}
		whs = append(whs, *wh)
	}

	MeshNetworks                   = schema.GroupVersionResource{Group: "", Version: "v1alpha1", Resource: "meshnetworks"}
	MutatingWebhookConfiguration   = schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1", Resource: "mutatingwebhookconfigurations"}

type Analyzer struct{}

var _ analysis.Analyzer = &Analyzer{}

// We assume that enablement is via an istio-injection=enabled or istio.io/rev namespace label
// In theory, there can be alternatives using Mutatingwebhookconfiguration, but they're very uncommon
// See https://istio.io/docs/ops/troubleshooting/injection/ for more info.
var (
	RevisionInjectionLabelName = label.IoIstioRev.Name
)

// Metadata implements Analyzer

			"testdata/webhook.yaml",
		},
		analyzer: &webhook.Analyzer{},
		expected: []message{
			{msg.InvalidWebhook, "MutatingWebhookConfiguration istio-sidecar-injector-missing-overlap"},
			{msg.InvalidWebhook, "MutatingWebhookConfiguration istio-sidecar-injector-missing-overlap"},
			{msg.InvalidWebhook, "MutatingWebhookConfiguration istio-sidecar-injector-overlap"},
		},
	},
	{
		name: "Route Rule no effect on Ingress",

// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
func (in *MutatingWebhookConfiguration) APILifecycleIntroduced() (major, minor int) {
	return 1, 16
}

          "clientConfig",
          "sideEffects",
          "admissionReviewVersions"
        ],
        "type": "object"
      },
      "io.k8s.api.admissionregistration.v1.MutatingWebhookConfiguration": {
        "description": "MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.",
        "properties": {
          "apiVersion": {

		metav1.ListOptions{LabelSelector: fmt.Sprintf("%s=%s", label.IoIstioRev.Name, revision)})
	if err != nil {
		return e, fmt.Errorf("could not find valid mutatingWebhookConfiguration %q from cluster %v",
			whcName, err)
	}
	if whcList != nil && len(whcList.Items) != 0 {
		for _, wh := range whcList.Items[0].Webhooks {
			if strings.HasSuffix(wh.Name, defaultWebhookName) {

    release: istio
  name: istio-reader-service-account
  namespace: istio-system
spec:
  automountServiceAccountToken: false

---


apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  labels:
    app: sidecar-injector
    install.operator.istio.io/owning-resource: unknown
    istio.io/rev: default
    operator.istio.io/component: Pilot
    release: istio