apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  annotations:
    certificates.kubevirt.io/secret: kubevirt-virt-api-certs
    kubevirt.io/customizer-identifier: bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
    kubevirt.io/generation: "3"
    kubevirt.io/install-strategy-identifier: 5dc642dcafc20b388aac8893d36db44393e586b9
    kubevirt.io/install-strategy-registry: ""
    kubevirt.io/install-strategy-version: sha256:031a34ff7b451f8588ed2960c576d6a835a749de7c168e88eaec45d180be6a21
  creationTimestamp: "2025-10-29T11:53:49Z"
  generation: 2
  labels:
    app.kubernetes.io/component: compute
    app.kubernetes.io/managed-by: virt-operator
    app.kubernetes.io/part-of: hyperconverged-cluster
    app.kubernetes.io/version: 4.19.12
    kubevirt.io: virt-api-validator
  name: virt-api-validator
  resourceVersion: "2228869"
  uid: 269eebaa-aed0-4ff7-a90d-de12803cabd2
webhooks:
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /launcher-eviction-validate
      port: 443
  failurePolicy: Fail
  matchConditions:
  - expression: object.metadata.name.startsWith("virt-launcher")
    name: only-vms
  matchPolicy: Equivalent
  name: virt-launcher-eviction-interceptor.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - '*'
    resources:
    - pods/eviction
    scope: '*'
  sideEffects: NoneOnDryRun
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /virtualmachineinstances-validate-create
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachineinstances-create-validator.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - kubevirt.io
    apiVersions:
    - v1alpha3
    - v1
    operations:
    - CREATE
    resources:
    - virtualmachineinstances
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /virtualmachineinstances-validate-update
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachineinstances-update-validator.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - kubevirt.io
    apiVersions:
    - v1alpha3
    - v1
    operations:
    - UPDATE
    resources:
    - virtualmachineinstances
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /virtualmachines-validate
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachine-validator.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - kubevirt.io
    apiVersions:
    - v1alpha3
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachines
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /virtualmachinereplicaset-validate
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachinereplicaset-validator.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - kubevirt.io
    apiVersions:
    - v1alpha3
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachineinstancereplicasets
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /virtualmachinepool-validate
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachinepool-validator.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - pool.kubevirt.io
    apiVersions:
    - v1alpha1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachinepools
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /vmipreset-validate
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachinepreset-validator.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - kubevirt.io
    apiVersions:
    - v1alpha3
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachineinstancepresets
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /migration-validate-create
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: migration-create-validator.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - kubevirt.io
    apiVersions:
    - v1alpha3
    - v1
    operations:
    - CREATE
    resources:
    - virtualmachineinstancemigrations
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /migration-validate-update
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: migration-update-validator.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - kubevirt.io
    apiVersions:
    - v1alpha3
    - v1
    operations:
    - UPDATE
    resources:
    - virtualmachineinstancemigrations
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /virtualmachinesnapshots-validate
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachinesnapshot-validator.snapshot.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - snapshot.kubevirt.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachinesnapshots
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /virtualmachinerestores-validate
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachinerestore-validator.snapshot.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - snapshot.kubevirt.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachinerestores
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /virtualmachineexports-validate
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachineexport-validator.export.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - export.kubevirt.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachineexports
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /virtualmachineinstancetypes-validate
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachineinstancetype-validator.instancetype.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - instancetype.kubevirt.io
    apiVersions:
    - v1alpha1
    - v1alpha2
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachineinstancetypes
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /virtualmachineclusterinstancetypes-validate
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachineclusterinstancetype-validator.instancetype.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - instancetype.kubevirt.io
    apiVersions:
    - v1alpha1
    - v1alpha2
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachineclusterinstancetypes
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /virtualmachinepreferences-validate
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachinepreference-validator.instancetype.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - instancetype.kubevirt.io
    apiVersions:
    - v1alpha1
    - v1alpha2
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachinepreferences
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /virtualmachineclusterpreferences-validate
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: virtualmachineclusterpreference-validator.instancetype.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - instancetype.kubevirt.io
    apiVersions:
    - v1alpha1
    - v1alpha2
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachineclusterpreferences
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /status-validate
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: kubevirt-crd-status-validator.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - kubevirt.io
    apiVersions:
    - v1alpha3
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachines/status
    - virtualmachineinstancereplicasets/status
    - virtualmachineinstancemigrations/status
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /migration-policy-validate-create
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: migration-policy-validator.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - migrations.kubevirt.io
    apiVersions:
    - v1alpha1
    operations:
    - CREATE
    - UPDATE
    resources:
    - migrationpolicies
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: virt-api
      namespace: openshift-cnv
      path: /vm-clone-validate-create
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: vm-clone-validator.kubevirt.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - clone.kubevirt.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - virtualmachineclones
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
