} return f.ClientSet.AdmissionregistrationV1().MutatingWebhookConfigurations().Create(config) } <ins> func newDenyPodWebhookFixture(f *framework.Framework, context *certContext) admissionregistrationv1.ValidatingWebhook { sideEffectsNone := admissionregistrationv1.SideEffectClassNone return admissionregistrationv1.ValidatingWebhook{ Name: "deny-unwanted-pod-container-name-and-label.k8s.io", Rules: []admissionregistrationv1.RuleWithOperations{{ Operations: []admissionregistrationv1.OperationType{admissionregistrationv1.Create}, Rule: admissionregistrationv1.Rule{ APIGroups:   []string{""}, APIVersions: []string{"v1"}, Resources:   []string{"pods"}, }, }}, ClientConfig: admissionregistrationv1.WebhookClientConfig{ Service: &admissionregistrationv1.ServiceReference{ Namespace: f.Namespace.Name, Name:      serviceName, Path:      strPtr("/pods"), Port:      pointer.Int32Ptr(servicePort), }, CABundle: context.signingCert, }, SideEffects:             &sideEffectsNone, AdmissionReviewVersions: []string{"v1beta1"}, // Scope the webhook to just this namespace NamespaceSelector: &metav1.LabelSelector{ MatchLabels: map[string]string{f.UniqueName: "true"}, }, } } func newDenyConfigMapWebhookFixture(f *framework.Framework, context *certContext) admissionregistrationv1.ValidatingWebhook { sideEffectsNone := admissionregistrationv1.SideEffectClassNone return admissionregistrationv1.ValidatingWebhook{ Name: "deny-unwanted-configmap-data.k8s.io", Rules: []admissionregistrationv1.RuleWithOperations{{ Operations: []admissionregistrationv1.OperationType{admissionregistrationv1.Create, admissionregistrationv1.Update, admissionregistrationv1.Delete}, Rule: admissionregistrationv1.Rule{ APIGroups:   []string{""}, APIVersions: []string{"v1"}, Resources:   []string{"configmaps"}, }, }}, // The webhook skips the namespace that has label "skip-webhook-admission":"yes" NamespaceSelector: &metav1.LabelSelector{ MatchLabels: map[string]string{f.UniqueName: "true"}, MatchExpressions: []metav1.LabelSelectorRequirement{ { Key:      skipNamespaceLabelKey, Operator: metav1.LabelSelectorOpNotIn, Values:   []string{skipNamespaceLabelValue}, }, }, }, ClientConfig: admissionregistrationv1.WebhookClientConfig{ Service: &admissionregistrationv1.ServiceReference{ Namespace: f.Namespace.Name, Name:      serviceName, Path:      strPtr("/configmaps"), Port:      pointer.Int32Ptr(servicePort), }, CABundle: context.signingCert, }, SideEffects:             &sideEffectsNone, AdmissionReviewVersions: []string{"v1beta1"}, } } func newMutateConfigMapWebhookFixture(f *framework.Framework, context *certContext, stage int) admissionregistrationv1.MutatingWebhook { sideEffectsNone := admissionregistrationv1.SideEffectClassNone return admissionregistrationv1.MutatingWebhook{ Name: fmt.Sprintf("adding-configmap-data-stage-%d.k8s.io", stage), Rules: []admissionregistrationv1.RuleWithOperations{{ Operations: []admissionregistrationv1.OperationType{admissionregistrationv1.Create}, Rule: admissionregistrationv1.Rule{ APIGroups:   []string{""}, APIVersions: []string{"v1"}, Resources:   []string{"configmaps"}, }, }}, ClientConfig: admissionregistrationv1.WebhookClientConfig{ Service: &admissionregistrationv1.ServiceReference{ Namespace: f.Namespace.Name, Name:      serviceName, Path:      strPtr("/mutating-configmaps"), Port:      pointer.Int32Ptr(servicePort), }, CABundle: context.signingCert, }, SideEffects:             &sideEffectsNone, AdmissionReviewVersions: []string{"v1beta1"}, // Scope the webhook to just this namespace NamespaceSelector: &metav1.LabelSelector{ MatchLabels: map[string]string{f.UniqueName: "true"}, }, } } </ins>