apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: {{ include "capsule.fullname" . }}-validating-webhook-configuration
  labels:
    {{- include "capsule.labels" . | nindent 4 }}
  annotations:
  {{- if .Values.certManager.generateCertificates }}
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "capsule.fullname" . }}-webhook-cert
  {{-  end }}
  {{- with .Values.customAnnotations }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
webhooks:
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
{{- if not .Values.certManager.generateCertificates }}
    caBundle: Cg==
{{- end }}
    service:
      name: {{ include "capsule.fullname" . }}-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /cordoning
      port: 443
  failurePolicy: {{ .Values.webhooks.cordoning.failurePolicy }}
  matchPolicy: Equivalent
  name: cordoning.tenant.capsule.clastix.io
  namespaceSelector:
  {{- toYaml .Values.webhooks.cordoning.namespaceSelector | nindent 4}}
  objectSelector: {}
  rules:
    - apiGroups:
        - '*'
      apiVersions:
        - '*'
      operations:
        - CREATE
        - UPDATE
        - DELETE
      resources:
        - '*'
      scope: Namespaced
  sideEffects: None
  timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
{{- if not .Values.certManager.generateCertificates }}
    caBundle: Cg==
{{- end }}
    service:
      name: {{ include "capsule.fullname" . }}-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /ingresses
      port: 443
  failurePolicy: {{ .Values.webhooks.ingresses.failurePolicy }}
  matchPolicy: Equivalent
  name: ingress.capsule.clastix.io
  namespaceSelector:
  {{- toYaml .Values.webhooks.ingresses.namespaceSelector | nindent 4}}
  objectSelector: {}
  rules:
    - apiGroups:
        - networking.k8s.io
        - extensions
      apiVersions:
        - v1
        - v1beta1
      operations:
        - CREATE
        - UPDATE
      resources:
        - ingresses
      scope: Namespaced
  sideEffects: None
  timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
{{- if not .Values.certManager.generateCertificates }}
    caBundle: Cg==
{{- end }}
    service:
      name: {{ include "capsule.fullname" . }}-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /namespaces
      port: 443
  failurePolicy: {{ .Values.webhooks.namespaces.failurePolicy }}
  matchPolicy: Equivalent
  name: namespaces.capsule.clastix.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
    - apiGroups:
        - ""
      apiVersions:
        - v1
      operations:
        - CREATE
        - UPDATE
        - DELETE
      resources:
        - namespaces
      scope: '*'
  sideEffects: None
  timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
{{- if not .Values.certManager.generateCertificates }}
    caBundle: Cg==
{{- end }}
    service:
      name: {{ include "capsule.fullname" . }}-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /networkpolicies
      port: 443
  failurePolicy: {{ .Values.webhooks.networkpolicies.failurePolicy }}
  matchPolicy: Equivalent
  name: networkpolicies.capsule.clastix.io
  namespaceSelector:
  {{- toYaml .Values.webhooks.networkpolicies.namespaceSelector | nindent 4}}
  objectSelector: {}
  rules:
    - apiGroups:
        - networking.k8s.io
      apiVersions:
        - v1
      operations:
        - UPDATE
        - DELETE
      resources:
        - networkpolicies
      scope: Namespaced
  sideEffects: None
  timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
{{- if not .Values.certManager.generateCertificates }}
    caBundle: Cg==
{{- end }}
    service:
      name: {{ include "capsule.fullname" . }}-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /nodes
      port: 443
  failurePolicy: {{ .Values.webhooks.nodes.failurePolicy }}
  name: nodes.capsule.clastix.io
  matchPolicy: Exact
  namespaceSelector: {}
  objectSelector: {}
  rules:
    - apiGroups:
        - ""
      apiVersions:
        - v1
      operations:
        - UPDATE
      resources:
        - nodes
  sideEffects: None
  timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
{{- if not .Values.certManager.generateCertificates }}
    caBundle: Cg==
{{- end }}
    service:
      name: {{ include "capsule.fullname" . }}-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /pods
      port: 443
  failurePolicy: {{ .Values.webhooks.pods.failurePolicy }}
  matchPolicy: Exact
  name: pods.capsule.clastix.io
  namespaceSelector:
  {{- toYaml .Values.webhooks.pods.namespaceSelector | nindent 4}}
  objectSelector: {}
  rules:
    - apiGroups:
        - ""
      apiVersions:
        - v1
      operations:
        - CREATE
        - UPDATE
      resources:
        - pods
      scope: Namespaced
  sideEffects: None
  timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
{{- if not .Values.certManager.generateCertificates }}
    caBundle: Cg==
{{- end }}
    service:
      name: {{ include "capsule.fullname" . }}-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /persistentvolumeclaims
  failurePolicy: {{ .Values.webhooks.persistentvolumeclaims.failurePolicy }}
  name: pvc.capsule.clastix.io
  namespaceSelector:
  {{- toYaml .Values.webhooks.persistentvolumeclaims.namespaceSelector | nindent 4}}
  objectSelector: {}
  rules:
    - apiGroups:
        - ""
      apiVersions:
        - v1
      operations:
        - CREATE
      resources:
        - persistentvolumeclaims
      scope: Namespaced
  sideEffects: None
  timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
{{- if not .Values.certManager.generateCertificates }}
    caBundle: Cg==
{{- end }}
    service:
      name: {{ include "capsule.fullname" . }}-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /services
      port: 443
  failurePolicy: {{ .Values.webhooks.services.failurePolicy }}
  matchPolicy: Exact
  name: services.capsule.clastix.io
  namespaceSelector:
  {{- toYaml .Values.webhooks.services.namespaceSelector | nindent 4}}
  objectSelector: {}
  rules:
    - apiGroups:
        - ""
      apiVersions:
        - v1
      operations:
        - CREATE
        - UPDATE
      resources:
        - services
      scope: Namespaced
  sideEffects: None
  timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
- admissionReviewVersions:
    - v1
    - v1beta1
  clientConfig:
{{- if not .Values.certManager.generateCertificates }}
    caBundle: Cg==
{{- end }}
    service:
      name: {{ include "capsule.fullname" . }}-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /tenants
      port: 443
  failurePolicy:  {{ .Values.webhooks.tenants.failurePolicy }}
  matchPolicy: Exact
  name: tenants.capsule.clastix.io
  namespaceSelector: {}
  objectSelector: {}
  rules:
    - apiGroups:
        - capsule.clastix.io
      apiVersions:
        - v1beta2
      operations:
        - CREATE
        - UPDATE
        - DELETE
      resources:
        - tenants
      scope: '*'
  sideEffects: None
  timeoutSeconds: {{ .Values.validatingWebhooksTimeoutSeconds }}
