
{{- $ca := genCA "webhook-change-group-webhook-ca" (.Values.certValidityDays | int) -}}
{{- $altNames := list ( printf "%s.%s" (include "webhook-injector.name" .) .Release.Namespace ) ( printf "%s.%s.svc" (include "webhook-injector.name" .) .Release.Namespace ) -}}
{{- $cert := genSignedCert ( include "webhook-injector.name" . ) nil $altNames (.Values.certValidityDays | int) $ca -}}

---
{{- if not ( and ( .Values.useServiceCAonOCP ) ( .Capabilities.APIVersions.Has "apps.openshift.io/v1/DeploymentConfig") )}}
apiVersion: v1
kind: Secret
type: kubernetes.io/tls
metadata:
  namespace: {{ .Release.Namespace }}
  name: {{ template "webhook-injector.name" . }}-certs
  labels:
    app: {{ template "webhook-injector.name" . }}
    chart: {{ template "webhook-injector.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
  annotations:
    # "helm.sh/hook": "pre-install"
    # "helm.sh/hook-delete-policy": "before-hook-creation"
data:
  {{- if not (hasKey .Values "certs") }}
  tls.crt: {{ $cert.Cert | b64enc | quote }}
  tls.key: {{ $cert.Key | b64enc | quote }}
  ca.crt: {{ $ca.Cert | b64enc | quote }}
  {{- else }}
  tls.crt: {{ .Values.certs.tlsCert | quote }}
  tls.key: {{ .Values.certs.tlsKey | quote }}
  ca.crt: {{ .Values.certs.caCert | quote }}
  {{- end }}
{{- end }}

---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  {{- if and ( .Values.useServiceCAonOCP ) ( .Capabilities.APIVersions.Has "apps.openshift.io/v1/DeploymentConfig") }}
  annotations:
    service.beta.openshift.io/inject-cabundle: 'true'
  {{- end }}
  name: {{ .Values.webhookName }}
webhooks:
  - name: {{ ( printf "%s.%s.svc" (include "webhook-injector.name" .) .Release.Namespace ) }}
    sideEffects: None
    admissionReviewVersions: ["v1", "v1beta1"]
    timeoutSeconds: {{ .Values.timeoutSeconds | int }}
    failurePolicy: {{ .Values.failurePolicy }}
    URL: https://webhook-injector.cavisson-wh.svc.cluster.local:8443/mutate
    clientConfig:
      {{ if not ( and ( .Values.useServiceCAonOCP ) ( .Capabilities.APIVersions.Has "apps.openshift.io/v1/DeploymentConfig") )}}
      {{ if not (hasKey .Values "certs") }}
      caBundle: {{ $ca.Cert | b64enc | quote }}
      {{ else }}
      caBundle: {{ .Values.certs.caCert | quote }}
      {{ end }}
      {{ end }}
    {{- if .Values.enabledForPodsWithLabels }}
    objectSelector:
      matchExpressions:
        {{ range $idx, $value := .Values.enabledForPodsWithLabels }}
        - key: {{ $value }}
          operator: Exists
        {{ end }}
    {{- end }}
    namespaceSelector:
      matchExpressions:
      {{- if .Values.namespacesEnabled }}
      - key: kubernetes.io/metadata.name
        operator: In
        values: [{{ range $index, $element := .Values.namespacesEnabled }}{{if $index}},{{end}}"{{$element}}"{{end}}]
      {{- end }}
      - key: kubernetes.io/metadata.name
        operator: NotIn
        values: [ {{ .Release.Namespace | quote }}{{ if .Values.namespacesDisabled }},{{ range $index, $element := .Values.namespacesDisabled }}{{if $index}},{{end}}"{{$element}}"{{end}}{{end}}]
    rules:
      - operations: [ "CREATE" ]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
