apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: {{ include "capsule.fullname" . }}-mutating-webhook-configuration
  labels:
    {{- include "capsule.labels" . | nindent 4 }}
  annotations:
  {{- if .Values.certManager.generateCertificates }}
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "capsule.fullname" . }}-webhook-cert
  {{-  end }}
  {{- with .Values.customAnnotations }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
webhooks:
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
{{- if not .Values.certManager.generateCertificates }}
    caBundle: Cg==
{{- end }}
    service:
      name: {{ include "capsule.fullname" . }}-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /namespace-owner-reference
      port: 443
  failurePolicy: {{ .Values.webhooks.namespaceOwnerReference.failurePolicy }}
  matchPolicy: Equivalent
  name: owner.namespace.capsule.clastix.io
  namespaceSelector: {}
  objectSelector: {}
  reinvocationPolicy: Never
  rules:
    - apiGroups:
      - ""
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - namespaces
      scope: '*'
  sideEffects: NoneOnDryRun
  timeoutSeconds: {{ .Values.mutatingWebhooksTimeoutSeconds }}
