apiVersion: apps/v1
kind: Deployment
metadata:
  name: tidb-operator-admission-webhook
  namespace: tidb-serverless
  labels:
    app.kubernetes.io/name: tidb-operator
    app.kubernetes.io/instance: tidb-operator
    app.kubernetes.io/component: admission-webhook
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: tidb-operator
      app.kubernetes.io/instance: tidb-operator
      app.kubernetes.io/component: admission-webhook
  template:
    metadata:
      labels:
        app.kubernetes.io/name: tidb-operator
        app.kubernetes.io/instance: tidb-operator
        app.kubernetes.io/component: admission-webhook
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: app.kubernetes.io/component
                    operator: In
                    values:
                      - admission-webhook
              topologyKey: kubernetes.io/hostname
      serviceAccountName: serverless-admission-webhook
      hostNetwork: true
      containers:
        - name: admission-webhook
          image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/tidb-operator:2ca4b6f0318cebe3e33c9f5405f8c86f8131607d
          imagePullPolicy: IfNotPresent
          command:
            - /usr/local/bin/tidb-admission-webhook
            # use > 1024 port, then we can run it as non-root user
            - --secure-port=6443
            - --v=2
            - --protected-namespaces={{ProtectedNamespaces}}
          livenessProbe:
            failureThreshold: 5
            httpGet:
              path: /healthz
              port: 6443
              scheme: HTTPS
            initialDelaySeconds: 5
            timeoutSeconds: 5
          readinessProbe:
            failureThreshold: 5
            httpGet:
              path: /healthz
              port: 6443
              scheme: HTTPS
            initialDelaySeconds: 5
            timeoutSeconds: 5
          env:
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: TZ
              value: UTC
          volumeMounts:
            - mountPath: /apiserver.local.config
              name: apiserver-local-config
      volumes:
        # rootfs maybe read-only, we need to an empty dir volume to store self-signed certifiates, etc.
        - name: apiserver-local-config
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: serverless-admission-webhook
  namespace: tidb-serverless
  labels:
    app.kubernetes.io/name: tidb-operator
    app.kubernetes.io/instance: tidb-operator
    app.kubernetes.io/component: admission-webhook
spec:
  ports:
    - name: https-webhook # optional
      port: 443
      targetPort: 6443
  selector:
    app.kubernetes.io/name: tidb-operator
    app.kubernetes.io/instance: tidb-operator
    app.kubernetes.io/component: admission-webhook
---
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1alpha1.admission.tidb.pingcap.com
  namespace: tidb-serverless
  labels:
    app.kubernetes.io/name: tidb-operator
    app.kubernetes.io/instance: tidb-operator
    app.kubernetes.io/component: admission-webhook
spec:
  insecureSkipTLSVerify: true
  group: admission.tidb.pingcap.com
  groupPriorityMinimum: 1000
  versionPriority: 15
  version: v1alpha1
  service:
    name: serverless-admission-webhook
    namespace: tidb-serverless
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: pingcap-serverless-resources-defaulitng
  namespace: tidb-serverless
  labels:
    app.kubernetes.io/name: tidb-operator
    app.kubernetes.io/instance: tidb-operator
    app.kubernetes.io/component: admission-webhook
webhooks:
  - name: defaulting.admission.tidb.pingcap.com
    admissionReviewVersions:
      - v1beta1
    failurePolicy: Fail
    sideEffects: None
    clientConfig:
      service:
        name: kubernetes
        namespace: default
        path: "/apis/admission.tidb.pingcap.com/v1alpha1/pingcapresourcemutations"
      caBundle: null
    rules:
      - operations:
          - UPDATE
          - CREATE
        apiGroups:
          - pingcap.com
        apiVersions:
          - v1alpha1
        resources:
          - tidbclusters
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: pingcap-serverless-resources-validating
  namespace: tidb-serverless
  labels:
    app.kubernetes.io/name: tidb-operator
    app.kubernetes.io/instance: tidb-operator
    app.kubernetes.io/component: admission-webhook
webhooks:
  - name: validating.admission.tidb.pingcap.com
    admissionReviewVersions:
      - v1beta1
    failurePolicy: Fail
    sideEffects: None
    clientConfig:
      service:
        name: kubernetes
        namespace: default
        path: "/apis/admission.tidb.pingcap.com/v1alpha1/pingcapresourcevalidations"
      caBundle: null
    rules:
      - operations:
          - UPDATE
          - CREATE
          - DELETE
        apiGroups:
          - pingcap.com
        apiVersions:
          - v1alpha1
        resources:
          - tidbclusters
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: pingcap-serverless-namespaces-validating
  namespace: tidb-serverless
  labels:
    app.kubernetes.io/name: tidb-operator
    app.kubernetes.io/instance: tidb-operator
    app.kubernetes.io/component: admission-webhook
webhooks:
  - name: validating.ns.admission.tidb.pingcap.com
    admissionReviewVersions:
      - v1beta1
    failurePolicy: Fail
    sideEffects: None
    clientConfig:
      service:
        name: kubernetes
        namespace: default
        path: "/apis/admission.tidb.pingcap.com/v1alpha1/namespacevalidations"
      caBundle: null
    rules:
      - operations:
          - DELETE
        apiGroups:
          - ""
        apiVersions:
          - v1
        resources:
          - namespaces
        scope: Cluster