---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  annotations:
    capability.openshift.io/name: Ingress
    include.release.openshift.io/ibm-cloud-managed: "true"
  creationTimestamp: "2026-11-03T08:32:43Z"
  generation: 1
  managedFields:
  - apiVersion: admissionregistration.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:observedGeneration: {}
        f:typeChecking: {}
    manager: validatingadmissionpolicy-status
    operation: Apply
    subresource: status
    time: "2026-11-03T08:32:43Z"
  - apiVersion: admissionregistration.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:capability.openshift.io/name: {}
          f:include.release.openshift.io/ibm-cloud-managed: {}
        f:ownerReferences:
          .: {}
          k:{"uid":"2167e43c-fa41-4020-83a8-a0e414480653"}: {}
      f:spec:
        f:failurePolicy: {}
        f:matchConditions:
          .: {}
          k:{"name":"check-only-gateway-api-crds"}:
            .: {}
            f:expression: {}
            f:name: {}
        f:matchConstraints: {}
        f:validations: {}
    manager: cluster-version-operator
    operation: Update
    time: "2026-11-03T08:32:43Z"
  name: openshift-ingress-operator-gatewayapi-crd-admission
  ownerReferences:
  - apiVersion: config.openshift.io/v1
    controller: true
    kind: ClusterVersion
    name: version
    uid: 2167e43c-fa41-4020-83a8-a0e414480653
  resourceVersion: "1927"
  uid: a446500a-c3a4-48dc-ae69-59b12fba99e7
spec:
  failurePolicy: Fail
  matchConditions:
  - expression: '(request.operation == ''DELETE'' ? oldObject : object).spec.group
      == ''gateway.networking.k8s.io'''
    name: check-only-gateway-api-crds
  matchConstraints:
    matchPolicy: Equivalent
    namespaceSelector: {}
    objectSelector: {}
    resourceRules:
    - apiGroups:
      - apiextensions.k8s.io
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      - DELETE
      resources:
      - customresourcedefinitions
      scope: '*'
  validations:
  - expression: has(request.userInfo.username) && (request.userInfo.username == 'system:serviceaccount:openshift-ingress-operator:ingress-operator')
    message: Gateway API Custom Resource Definitions are managed by the Ingress Operator
      and may not be modified
    reason: Forbidden
status:
  observedGeneration: 1
  typeChecking: {}