if err != nil {
		return "", fmt.Errorf("could not decode generated webhook: %w", err)
	}
	decodedWh := whObject.(*admitv1.MutatingWebhookConfiguration)
	for i := range decodedWh.Webhooks {
		decodedWh.Webhooks[i].ClientConfig.CABundle = []byte(config.CABundle)
		if decodedWh.Webhooks[i].ClientConfig.Service != nil {
			decodedWh.Webhooks[i].ClientConfig.Service.Path = &config.Path
		}
	}
	if opts.WebhookName != "" {

		scope.Debugf("failurePolicy is Ignore, but webhook is not ready; not setting to Fail")
		updateFailurePolicy = false
	}
	updated := current.DeepCopy()
	for i := range updated.Webhooks {
		updated.Webhooks[i].ClientConfig.CABundle = caBundle
		if updateFailurePolicy {
			updated.Webhooks[i].FailurePolicy = ptr.Of(kubeApiAdmission.Fail)
		}
	}

	latest, err := c.webhooks.Update(updated)
	if err != nil {

apiVersion: release-notes/v2
kind: feature
area: installation

# issue is a list of GitHub issues resolved in this note.
issue: []

releaseNotes:
  - |

apiVersion: release-notes/v2
kind: bug-fix
area: installation
issue:
- 18771
- 18838
releaseNotes:
 - |
  **Upgraded** the CRD and Webhook versions to `v1`.
upgradeNotes:
 - title: Require Kubernetes 1.16+

apiVersion: release-notes/v2
kind: feature
area: istioctl
issue:
  - 29153

releaseNotes:
  - |

			reinvocationCtx.SetIsReinvoke()
			for webhook, expectReinvoke := range tt.ExpectReinvokeWebhooks {
				shouldReinvoke := reinvocationCtx.Value(PluginName).(*webhookReinvokeContext).ShouldReinvokeWebhook(fmt.Sprintf("test-webhooks/%s/0", webhook))
				if expectReinvoke != shouldReinvoke {
					t.Errorf("expected reinvocationContext.ShouldReinvokeWebhook(%s)=%t, but got %t", webhook, expectReinvoke, shouldReinvoke)
				}
			}
		})

	if err != nil {
		return nil, fmt.Errorf("could not get validating webhook config %q: %v", name, err)
	}
	return whc, nil
}

func verifyValidatingWebhookConfiguration(c *kubeApiAdmission.ValidatingWebhookConfiguration) error {
	if len(c.Webhooks) == 0 {
		return errors.New("no webhook entries found")
	}
	for i, wh := range c.Webhooks {
		if *wh.FailurePolicy != kubeApiAdmission.Fail {

        resources:
          - "*"
    {{- if .Values.base.validationCABundle }}
    # Disable webhook controller in Pilot to stop patching it
    failurePolicy: Fail
    {{- else }}
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.
    failurePolicy: Ignore
    {{- end }}
    sideEffects: None

	go c.Run(controllerStop)
	webhooks := clienttest.Wrap(t, c.webhooks)
	fetch := func(name string) func() *admission.ValidatingWebhookConfiguration {
		return func() *admission.ValidatingWebhookConfiguration {
			return webhooks.Get(name, "")
		}
	}
	// install adds the webhook config with fail open policy
	webhooks.Create(unpatchedWebhookConfig)
	// verify the webhook isn't updated if invalid config is accepted.

<?xml version="1.0" encoding="UTF-8"?>
<settings>
  <webhooks enabled="true">
    <webhook url="https://gradle-bot.grdev.net/teamcity_slacktemplate" enabled="true" template="slack.com">
      <states>
        <state type="buildAddedToQueue" enabled="false" />
        <state type="buildRemovedFromQueue" enabled="true" />
        <state type="buildStarted" enabled="true" />
        <state type="changesLoaded" enabled="true" />