{{- if .Values.admissionWebhook.create }}
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1alpha1.admission.tidb.pingcap.com
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: admission-webhook
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
spec:
  {{- if .Values.admissionWebhook.apiservice.insecureSkipTLSVerify }}
  insecureSkipTLSVerify: true
  {{- else }}
  caBundle: {{ .Values.admissionWebhook.apiservice.caBundle }}
  {{- end }}
  group: admission.tidb.pingcap.com
  groupPriorityMinimum: 1000
  versionPriority: 15
  version: v1alpha1
  service:
    name: tidb-admission-webhook
    namespace: {{ .Release.Namespace }}
---
{{- if .Values.admissionWebhook.validation.statefulSets }}
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: validation-tidb-statefulset-webhook-cfg
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: admission-webhook
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
webhooks:
  - name: stsadmission.tidb.pingcap.com
    objectSelector:
      matchLabels:
        "app.kubernetes.io/managed-by": "tidb-operator"
    admissionReviewVersions: ["v1"]
    failurePolicy: {{ .Values.admissionWebhook.failurePolicy.validation | default "Fail" }}
    sideEffects: None
    clientConfig:
      service:
        name: kubernetes
        namespace: default
        path: "/apis/admission.tidb.pingcap.com/v1alpha1/statefulsetvalidations"
      {{- if .Values.admissionWebhook.cabundle }}
      caBundle: {{ .Values.admissionWebhook.cabundle }}
      {{- else }}
      caBundle: null
      {{- end }}
    rules:
      - operations: [ "UPDATE" ]
        apiGroups: [ "apps" ]
        apiVersions: ["v1beta1", "v1"]
        resources: ["statefulsets"]
      - operations: [ "UPDATE" ]
        apiGroups: [ "apps.pingcap.com"]
        apiVersions: ["v1alpha1", "v1"]
        resources: ["statefulsets"]
{{- end }}
---
{{- if .Values.admissionWebhook.validation.pingcapResources }}
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: pingcap-tidb-resources-validating
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: admission-webhook
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
webhooks:
  - name: validating.admission.tidb.pingcap.com
    admissionReviewVersions: ["v1"]
    failurePolicy: {{ .Values.admissionWebhook.failurePolicy.validation | default "Fail" }}
    sideEffects: None
    clientConfig:
      service:
        name: kubernetes
        namespace: default
        path: "/apis/admission.tidb.pingcap.com/v1alpha1/pingcapresourcevalidations"
      {{- if .Values.admissionWebhook.cabundle }}
      caBundle: {{ .Values.admissionWebhook.cabundle }}
      {{- else }}
      caBundle: null
      {{- end }}
    rules:
      - operations: [ "UPDATE", "CREATE" ]
        apiGroups: [ "pingcap.com"]
        apiVersions: ["v1alpha1"]
        resources: ["tidbclusters"]
{{- end }}
---
{{- if .Values.admissionWebhook.mutation.pingcapResources }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: pingcap-tidb-resources-defaulitng
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: admission-webhook
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
webhooks:
  - name: defaulting.admission.tidb.pingcap.com
    admissionReviewVersions: ["v1"]
    failurePolicy: {{ .Values.admissionWebhook.failurePolicy.mutation | default "Fail" }}
    sideEffects: None
    clientConfig:
      service:
        name: kubernetes
        namespace: default
        path: "/apis/admission.tidb.pingcap.com/v1alpha1/pingcapresourcemutations"
      {{- if .Values.admissionWebhook.cabundle }}
      caBundle: {{ .Values.admissionWebhook.cabundle }}
      {{- else }}
      caBundle: null
      {{- end }}
    rules:
      - operations: [ "UPDATE", "CREATE" ]
        apiGroups: [ "pingcap.com"]
        apiVersions: ["v1alpha1"]
        resources: ["tidbclusters"]
{{- end }}
{{- end }}