selectorsyncset.yaml

apiVersion: template.openshift.io/v1
kind: Template
metadata:
  creationTimestamp: null
  name: selectorsyncset-template
objects:
- apiVersion: hive.openshift.io/v1
  kind: SelectorSyncSet
  metadata:
    creationTimestamp: null
    labels:
      managed.openshift.io/gitHash: ${IMAGE_TAG}
      managed.openshift.io/gitRepoName: ${REPO_NAME}
      managed.openshift.io/osd: "true"
    name: managed-cluster-validating-webhooks-0
  spec:
    clusterDeploymentSelector:
      matchLabels:
        api.openshift.com/managed: "true"
    resourceApplyMode: Sync
    resources:
    - apiVersion: v1
      kind: Namespace
      metadata:
        creationTimestamp: null
        labels:
          openshift.io/cluster-monitoring: "true"
        name: openshift-validation-webhook
      spec: {}
      status: {}
    - apiVersion: v1
      kind: ServiceAccount
      metadata:
        creationTimestamp: null
        name: validation-webhook
        namespace: openshift-validation-webhook
    - apiVersion: rbac.authorization.k8s.io/v1
      kind: Role
      metadata:
        creationTimestamp: null
        name: validation-webhook
        namespace: openshift-validation-webhook
      rules:
      - apiGroups:
        - ""
        resources:
        - services
        verbs:
        - '*'
      - apiGroups:
        - monitoring.coreos.com
        resources:
        - servicemonitors
        verbs:
        - '*'
    - apiVersion: rbac.authorization.k8s.io/v1
      kind: RoleBinding
      metadata:
        creationTimestamp: null
        name: validation-webhook:validation-webhook
        namespace: openshift-validation-webhook
      roleRef:
        apiGroup: rbac.authorization.k8s.io
        kind: Role
        name: validation-webhook
      subjects:
      - kind: ServiceAccount
        name: validation-webhook
        namespace: openshift-validation-webhook
    - apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: validation-webhook
      rules:
      - apiGroups:
        - imageregistry.operator.openshift.io
        resources:
        - configs
        verbs:
        - get
    - apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: validation-webhook:validation-webhook
      roleRef:
        apiGroup: rbac.authorization.k8s.io
        kind: ClusterRole
        name: validation-webhook
      subjects:
      - kind: ServiceAccount
        name: validation-webhook
        namespace: openshift-validation-webhook
    - apiVersion: rbac.authorization.k8s.io/v1
      kind: Role
      metadata:
        creationTimestamp: null
        name: prometheus-k8s
        namespace: openshift-validation-webhook
      rules:
      - apiGroups:
        - ""
        resources:
        - services
        - endpoints
        - pods
        verbs:
        - get
        - list
        - watch
    - apiVersion: rbac.authorization.k8s.io/v1
      kind: RoleBinding
      metadata:
        creationTimestamp: null
        name: prometheus-k8s
        namespace: openshift-validation-webhook
      roleRef:
        apiGroup: rbac.authorization.k8s.io
        kind: Role
        name: prometheus-k8s
      subjects:
      - kind: ServiceAccount
        name: prometheus-k8s
        namespace: openshift-monitoring
    - apiVersion: monitoring.coreos.com/v1
      kind: ServiceMonitor
      metadata:
        creationTimestamp: null
        name: validating-webhook-metrics
        namespace: openshift-validation-webhook
      spec:
        endpoints:
        - bearerTokenSecret:
            key: ""
          port: metrics
        namespaceSelector:
          matchNames:
          - openshift-validation-webhook
        selector:
          matchLabels:
            app: validation-webhook
    - apiVersion: v1
      kind: ConfigMap
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: webhook-cert
        namespace: openshift-validation-webhook
    - apiVersion: v1
      kind: Service
      metadata:
        annotations:
          service.beta.openshift.io/serving-cert-secret-name: webhook-cert
        creationTimestamp: null
        labels:
          hypershift.openshift.io/allow-guest-webhooks: "true"
          name: validation-webhook
        name: validation-webhook
        namespace: openshift-validation-webhook
      spec:
        ports:
        - name: https
          port: 443
          protocol: TCP
          targetPort: 5000
        selector:
          app: validation-webhook
        type: ClusterIP
      status:
        loadBalancer: {}
    - apiVersion: apps/v1
      kind: DaemonSet
      metadata:
        creationTimestamp: null
        labels:
          app: validation-webhook
        name: validation-webhook
        namespace: openshift-validation-webhook
      spec:
        selector:
          matchLabels:
            app: validation-webhook
        template:
          metadata:
            creationTimestamp: null
            labels:
              app: validation-webhook
          spec:
            affinity:
              nodeAffinity:
                requiredDuringSchedulingIgnoredDuringExecution:
                  nodeSelectorTerms:
                  - matchExpressions:
                    - key: node-role.kubernetes.io/master
                      operator: In
                      values:
                      - ""
            containers:
            - command:
              - webhooks
              - -tlskey
              - /service-certs/tls.key
              - -tlscert
              - /service-certs/tls.crt
              - -cacert
              - /service-ca/service-ca.crt
              - -tls
              image: ${REGISTRY_IMG}@${IMAGE_DIGEST}
              imagePullPolicy: IfNotPresent
              name: webhooks
              ports:
              - containerPort: 5000
              resources: {}
              volumeMounts:
              - mountPath: /service-certs
                name: service-certs
                readOnly: true
              - mountPath: /service-ca
                name: service-ca
                readOnly: true
            restartPolicy: Always
            serviceAccount: ""
            serviceAccountName: validation-webhook
            tolerations:
            - effect: NoSchedule
              key: node-role.kubernetes.io/master
            - effect: NoExecute
              key: node-role.kubernetes.io/master
            volumes:
            - name: service-certs
              secret:
                secretName: webhook-cert
            - configMap:
                name: webhook-cert
              name: service-ca
        updateStrategy:
          rollingUpdate:
            maxUnavailable: 1
          type: RollingUpdate
      status:
        currentNumberScheduled: 0
        desiredNumberScheduled: 0
        numberMisscheduled: 0
        numberReady: 0
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-clusterrolebindings-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /clusterrolebindings-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: clusterrolebindings-validation.managed.openshift.io
        rules:
        - apiGroups:
          - rbac.authorization.k8s.io
          apiVersions:
          - v1
          operations:
          - DELETE
          resources:
          - clusterrolebindings
          scope: Cluster
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-customresourcedefinitions-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /customresourcedefinitions-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: customresourcedefinitions-validation.managed.openshift.io
        rules:
        - apiGroups:
          - apiextensions.k8s.io
          apiVersions:
          - '*'
          operations:
          - CREATE
          - UPDATE
          - DELETE
          resources:
          - customresourcedefinitions
          scope: Cluster
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-hiveownership-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /hiveownership-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: hiveownership-validation.managed.openshift.io
        objectSelector:
          matchLabels:
            hive.openshift.io/managed: "true"
        rules:
        - apiGroups:
          - quota.openshift.io
          apiVersions:
          - '*'
          operations:
          - UPDATE
          - DELETE
          resources:
          - clusterresourcequotas
          scope: Cluster
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-imagecontentpolicies-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /imagecontentpolicies-validation
        failurePolicy: Fail
        matchPolicy: Equivalent
        name: imagecontentpolicies-validation.managed.openshift.io
        rules:
        - apiGroups:
          - config.openshift.io
          apiVersions:
          - '*'
          operations:
          - CREATE
          - UPDATE
          resources:
          - imagedigestmirrorsets
          - imagetagmirrorsets
          scope: Cluster
        - apiGroups:
          - operator.openshift.io
          apiVersions:
          - '*'
          operations:
          - CREATE
          - UPDATE
          resources:
          - imagecontentsourcepolicies
          scope: Cluster
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-ingress-config-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /ingressconfig-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: ingress-config-validation.managed.openshift.io
        rules:
        - apiGroups:
          - config.openshift.io
          apiVersions:
          - '*'
          operations:
          - CREATE
          - UPDATE
          - DELETE
          resources:
          - ingresses
          scope: Cluster
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-namespace-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /namespace-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: namespace-validation.managed.openshift.io
        rules:
        - apiGroups:
          - ""
          apiVersions:
          - '*'
          operations:
          - CREATE
          - UPDATE
          - DELETE
          resources:
          - namespaces
          scope: Cluster
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-networkpolicies-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /networkpolicies-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: networkpolicies-validation.managed.openshift.io
        rules:
        - apiGroups:
          - networking.k8s.io
          apiVersions:
          - '*'
          operations:
          - CREATE
          - UPDATE
          - DELETE
          resources:
          - networkpolicies
          scope: Namespaced
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-node-validation-osd
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /node-validation-osd
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: node-validation-osd.managed.openshift.io
        rules:
        - apiGroups:
          - ""
          apiVersions:
          - '*'
          operations:
          - CREATE
          - UPDATE
          - DELETE
          resources:
          - nodes
          - nodes/*
          scope: '*'
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-pod-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /pod-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: pod-validation.managed.openshift.io
        rules:
        - apiGroups:
          - v1
          apiVersions:
          - '*'
          operations:
          - '*'
          resources:
          - pods
          scope: Namespaced
        sideEffects: None
        timeoutSeconds: 1
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-prometheusrule-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /prometheusrule-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: prometheusrule-validation.managed.openshift.io
        rules:
        - apiGroups:
          - monitoring.coreos.com
          apiVersions:
          - '*'
          operations:
          - CREATE
          - UPDATE
          - DELETE
          resources:
          - prometheusrules
          scope: Namespaced
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-regular-user-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /regularuser-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: regular-user-validation.managed.openshift.io
        rules:
        - apiGroups:
          - cloudcredential.openshift.io
          - machine.openshift.io
          - admissionregistration.k8s.io
          - addons.managed.openshift.io
          - cloudingress.managed.openshift.io
          - managed.openshift.io
          - ocmagent.managed.openshift.io
          - splunkforwarder.managed.openshift.io
          - upgrade.managed.openshift.io
          apiVersions:
          - '*'
          operations:
          - '*'
          resources:
          - '*/*'
          scope: '*'
        - apiGroups:
          - autoscaling.openshift.io
          apiVersions:
          - '*'
          operations:
          - '*'
          resources:
          - clusterautoscalers
          - machineautoscalers
          scope: '*'
        - apiGroups:
          - config.openshift.io
          apiVersions:
          - '*'
          operations:
          - '*'
          resources:
          - clusterversions
          - clusterversions/status
          - schedulers
          - apiservers
          - proxies
          scope: '*'
        - apiGroups:
          - ""
          apiVersions:
          - '*'
          operations:
          - CREATE
          - UPDATE
          - DELETE
          resources:
          - configmaps
          scope: '*'
        - apiGroups:
          - machineconfiguration.openshift.io
          apiVersions:
          - '*'
          operations:
          - '*'
          resources:
          - machineconfigs
          - machineconfigpools
          scope: '*'
        - apiGroups:
          - operator.openshift.io
          apiVersions:
          - '*'
          operations:
          - '*'
          resources:
          - kubeapiservers
          - openshiftapiservers
          scope: '*'
        - apiGroups:
          - managed.openshift.io
          apiVersions:
          - '*'
          operations:
          - '*'
          resources:
          - subjectpermissions
          - subjectpermissions/*
          scope: '*'
        - apiGroups:
          - network.openshift.io
          apiVersions:
          - '*'
          operations:
          - '*'
          resources:
          - netnamespaces
          - netnamespaces/*
          scope: '*'
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-scc-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /scc-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: scc-validation.managed.openshift.io
        rules:
        - apiGroups:
          - security.openshift.io
          apiVersions:
          - '*'
          operations:
          - UPDATE
          - DELETE
          resources:
          - securitycontextconstraints
          scope: Cluster
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-sdn-migration-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /sdnmigration-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: sdn-migration-validation.managed.openshift.io
        rules:
        - apiGroups:
          - config.openshift.io
          apiVersions:
          - '*'
          operations:
          - UPDATE
          resources:
          - networks
          scope: Cluster
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-serviceaccount-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /serviceaccount-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: serviceaccount-validation.managed.openshift.io
        rules:
        - apiGroups:
          - ""
          apiVersions:
          - v1
          operations:
          - DELETE
          resources:
          - serviceaccounts
          scope: Namespaced
        sideEffects: None
        timeoutSeconds: 2
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-techpreviewnoupgrade-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /techpreviewnoupgrade-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: techpreviewnoupgrade-validation.managed.openshift.io
        rules:
        - apiGroups:
          - config.openshift.io
          apiVersions:
          - '*'
          operations:
          - CREATE
          - UPDATE
          resources:
          - featuregates
          scope: Cluster
        sideEffects: None
        timeoutSeconds: 1
  status: {}
- apiVersion: hive.openshift.io/v1
  kind: SelectorSyncSet
  metadata:
    creationTimestamp: null
    labels:
      managed.openshift.io/gitHash: ${IMAGE_TAG}
      managed.openshift.io/gitRepoName: ${REPO_NAME}
      managed.openshift.io/osd: "true"
    name: managed-cluster-validating-webhooks-1
  spec:
    clusterDeploymentSelector:
      matchExpressions:
      - key: hive.openshift.io/version-major-minor
        operator: In
        values:
        - "4.4"
        - "4.5"
        - "4.6"
      matchLabels:
        api.openshift.com/managed: "true"
    resourceApplyMode: Sync
    resources:
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-clusterlogging-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /clusterlogging-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: clusterlogging-validation.managed.openshift.io
        rules:
        - apiGroups:
          - logging.openshift.io
          apiVersions:
          - v1
          operations:
          - CREATE
          - UPDATE
          resources:
          - clusterloggings
          scope: Namespaced
        sideEffects: None
        timeoutSeconds: 1
  status: {}
- apiVersion: hive.openshift.io/v1
  kind: SelectorSyncSet
  metadata:
    creationTimestamp: null
    labels:
      managed.openshift.io/gitHash: ${IMAGE_TAG}
      managed.openshift.io/gitRepoName: ${REPO_NAME}
      managed.openshift.io/osd: "true"
    name: managed-cluster-validating-webhooks-2
  spec:
    clusterDeploymentSelector:
      matchExpressions:
      - key: ext-managed.openshift.io/legacy-ingress-support
        operator: In
        values:
        - "false"
      matchLabels:
        api.openshift.com/managed: "true"
    resourceApplyMode: Sync
    resources:
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingWebhookConfiguration
      metadata:
        annotations:
          service.beta.openshift.io/inject-cabundle: "true"
        creationTimestamp: null
        name: sre-ingresscontroller-validation
      webhooks:
      - admissionReviewVersions:
        - v1
        clientConfig:
          service:
            name: validation-webhook
            namespace: openshift-validation-webhook
            path: /ingresscontroller-validation
        failurePolicy: Ignore
        matchPolicy: Equivalent
        name: ingresscontroller-validation.managed.openshift.io
        rules:
        - apiGroups:
          - operator.openshift.io
          apiVersions:
          - '*'
          operations:
          - CREATE
          - UPDATE
          resources:
          - ingresscontroller
          - ingresscontrollers
          scope: Namespaced
        sideEffects: None
        timeoutSeconds: 1
  status: {}
parameters:
- name: IMAGE_TAG
  required: true
- name: REPO_NAME
  required: true
  value: managed-cluster-validating-webhooks
- name: REGISTRY_IMG
  required: true
- name: IMAGE_DIGEST
  required: true