webhook.yaml

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: pmem-csi-intel-com-hook
webhooks:
  - name: pod-hook.pmem-csi.intel.com
    namespaceSelector:
      matchExpressions:
      - key: pmem-csi.intel.com/webhook
        operator: NotIn
        values: ["ignore"]
    objectSelector:
      matchExpressions:
      - key: pmem-csi.intel.com/webhook
        operator: NotIn
        values: ["ignore"]
    # For pods with PMEM volumes using late binding, not activating the
    # scheduler extension is okayish (but see https://github.com/kubernetes-csi/external-provisioner/issues/544).
    # It's worse for CSI ephemeral volumes because there is no recovery.
    # Nonetheless, failing pod scheduling entirely when PMEM-CSI is down
    # seems worse, so we let the scheduler continue despite failures.
    failurePolicy: Ignore
    sideEffects: None
    admissionReviewVersions: ["v1"]
    clientConfig:
      service:
        name: pmem-csi-intel-com-scheduler
        namespace: pmem-csi
        path: /pod/mutate
      caBundle:
    rules:
      - operations: ["CREATE"]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]