---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  annotations:
    capability.openshift.io/name: Ingress
    include.release.openshift.io/ibm-cloud-managed: "true"
  creationTimestamp: "2026-10-30T01:09:58Z"
  generation: 1
  managedFields:
  - apiVersion: admissionregistration.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:observedGeneration: {}
        f:typeChecking: {}
    manager: validatingadmissionpolicy-status
    operation: Apply
    subresource: status
    time: "2026-10-30T01:09:58Z"
  - apiVersion: admissionregistration.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:capability.openshift.io/name: {}
          f:include.release.openshift.io/ibm-cloud-managed: {}
        f:ownerReferences:
          .: {}
          k:{"uid":"bb24ad69-82c4-41e7-a963-aa2e7769871d"}: {}
      f:spec:
        f:failurePolicy: {}
        f:matchConditions:
          .: {}
          k:{"name":"check-only-gateway-api-crds"}:
            .: {}
            f:expression: {}
            f:name: {}
        f:matchConstraints: {}
        f:validations: {}
    manager: cluster-version-operator
    operation: Update
    time: "2026-10-30T01:09:58Z"
  name: openshift-ingress-operator-gatewayapi-crd-admission
  ownerReferences:
  - apiVersion: config.openshift.io/v1
    controller: true
    kind: ClusterVersion
    name: version
    uid: bb24ad69-82c4-41e7-a963-aa2e7769871d
  resourceVersion: "1995"
  uid: b326b3d1-894b-427d-9468-66c3b9af4e6d
spec:
  failurePolicy: Fail
  matchConditions:
  - expression: '(request.operation == ''DELETE'' ? oldObject : object).spec.group
      == ''gateway.networking.k8s.io'''
    name: check-only-gateway-api-crds
  matchConstraints:
    matchPolicy: Equivalent
    namespaceSelector: {}
    objectSelector: {}
    resourceRules:
    - apiGroups:
      - apiextensions.k8s.io
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      - DELETE
      resources:
      - customresourcedefinitions
      scope: '*'
  validations:
  - expression: has(request.userInfo.username) && (request.userInfo.username == 'system:serviceaccount:openshift-ingress-operator:ingress-operator')
    message: Gateway API Custom Resource Definitions are managed by the Ingress Operator
      and may not be modified
    reason: Forbidden
status:
  observedGeneration: 1
  typeChecking: {}