MutatingWebhookConfiguration for Kubernetes 1.21+

mutating-webhook-configuration.yaml

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: "tumblr-sidecar-injector-webhook"
  labels:
    app: k8s-sidecar-injector
    track: test
webhooks:
- name: "injector.tumblr.com"
  failurePolicy: "Ignore" # we fail "open" if the webhook is down hard
  sideEffects: "None"
  admissionReviewVersions: ["v1beta1"]
  rules:
  - operations: [ "CREATE" ]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
    scope: "Namespaced"
  clientConfig:
    # https://github.com/kubernetes/kubernetes/blob/v1.10.0-beta.1/staging/src/k8s.io/api/admissionregistration/v1beta1/types.go#L218
    # note: k8s is smart enough to use 443 or the only exposed port on the service
    # note: this requires the service to serve TLS directly (not thru ingress)
    service:
      name: "k8s-sidecar-injector"
      namespace: "kube-system"
      path: "/mutate"   # what /url/slug to send requests at
    caBundle: <<CA_BUNDLE>>