From 51de06b36a2b69daee48a9a2ab6002b265f157d7 Mon Sep 17 00:00:00 2001
From: Taahir Ahmed <taahm@google.com>
Date: Wed, 24 Jul 2019 08:26:17 -0700
Subject: [PATCH] ImagePolicyWebhook: config can be embedded (#15233)

All admission control plugins support two modes for specifying their
configuration: linking to an external file using the `path` key in the
shared admission configuration file, or directly embedding the
configuration using the `configuration` key in the shared admission
configuration file.

This commit makes the ImagePolicyWebhook documentation mention the
embedded configuration option.
---
 .../access-authn-authz/admission-controllers.md  | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/content/en/docs/reference/access-authn-authz/admission-controllers.md b/content/en/docs/reference/access-authn-authz/admission-controllers.md
index 5b7a8c2c1a..41e8a0acbc 100644
--- a/content/en/docs/reference/access-authn-authz/admission-controllers.md
+++ b/content/en/docs/reference/access-authn-authz/admission-controllers.md
@@ -249,6 +249,22 @@ plugins:
 ...
 ```
 
+Alternatively, you can embed the configuration directly in the file:
+
+```yaml
+apiVersion: apiserver.k8s.io/v1alpha1
+kind: AdmissionConfiguration
+plugins:
+- name: ImagePolicyWebhook
+  configuration:
+    imagePolicy:
+      kubeConfigFile: /path/to/file
+      allowTTL: 50
+      denyTTL: 50
+      retryBackoff: 500
+      defaultAllow: true
+```
+
 The ImagePolicyWebhook config file must reference a [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/) formatted file which sets up the connection to the backend. It is required that the backend communicate over TLS.
 
 The kubeconfig file's cluster field must point to the remote service, and the user field must contain the returned authorizer.