apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: istiod-default-validator
  labels:
    app: istiod
    istio: istiod
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    istio.io/tag: "default"
    # Required to make sure this resource is removed
    # when purging Istio resources
    operator.istio.io/component: Pilot
webhooks:
  - name: validation.istio.io

  // +optional
  repeated MatchCondition matchConditions = 11;
}

// ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
// Deprecated in v1.16, planned for removal in v1.19. Use admissionregistration.k8s.io/v1 ValidatingWebhookConfiguration instead.
message ValidatingWebhookConfiguration {

		return gvk.Telemetry, true
	case *sigsk8siogatewayapiapisv1alpha2.UDPRoute:
		return gvk.UDPRoute, true
	case *k8sioapiadmissionregistrationv1.ValidatingWebhookConfiguration:
		return gvk.ValidatingWebhookConfiguration, true
	case *istioioapinetworkingv1alpha3.VirtualService:
		return gvk.VirtualService, true
	case *apiistioioapinetworkingv1alpha3.VirtualService:
		return gvk.VirtualService, true

		}
	}
	return
}

// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingWebhookConfiguration.
func (in *ValidatingWebhookConfiguration) DeepCopy() *ValidatingWebhookConfiguration {
	if in == nil {
		return nil
	}
	out := new(ValidatingWebhookConfiguration)
	in.DeepCopyInto(out)
	return out
}

// Package v1 is the v1 version of the API.
// AdmissionConfiguration and AdmissionPluginConfiguration are legacy static admission plugin configuration
// MutatingWebhookConfiguration and ValidatingWebhookConfiguration are for the
// new dynamic admission controller configuration.

{{- if not (eq .Values.defaultRevision "") }}
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: istiod-default-validator
  labels:
    app: istiod
    release: {{ .Release.Name }}
    istio: istiod
    istio.io/rev: {{ .Values.defaultRevision | quote }}
webhooks:
  - name: validation.istio.io
    clientConfig:
      {{- if .Values.base.validationURL }}
      url: {{ .Values.base.validationURL }}

{{- if .Values.global.configValidation }}
{{- if hasKey .Values.base.tags "default" }}
{{- $tag := .Values.base.tags.default }}
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: istiod-default-validator
  labels:
    app: istiod
    istio: istiod
    istio.io/rev: {{ $tag.revision | default "default" }}
    istio.io/tag: "default"
    # Required to make sure this resource is removed

		}
	}
	return
}

// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingWebhookConfiguration.
func (in *ValidatingWebhookConfiguration) DeepCopy() *ValidatingWebhookConfiguration {
	if in == nil {
		return nil
	}
	out := new(ValidatingWebhookConfiguration)
	in.DeepCopyInto(out)
	return out
}

{{- if .Values.global.configCluster }}
{{- if not (eq .Values.defaultRevision "") }}
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: istiod-default-validator
  labels:
    app: istiod
    release: {{ .Release.Name }}
    istio: istiod
    istio.io/rev: {{ .Values.defaultRevision | quote }}
webhooks:
  - name: validation.istio.io
    clientConfig:
      {{- if .Values.base.validationURL }}

// the admission of a ValidatingWebhookConfiguration or a MutatingWebhookConfiguration or a ValidatingAdmissionPolicy or a ValidatingAdmissionPolicyBinding
func IsExemptAdmissionConfigurationResource(attr admission.Attributes) bool {
	gvk := attr.GetKind()
	if gvk.Group == "admissionregistration.k8s.io" {