{{ $tls := fromYaml ( include "aws-load-balancer-controller.webhookCerts" . ) }}
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
{{- if $.Values.enableCertManager }}
  annotations:
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "aws-load-balancer-controller.namePrefix" . }}-serving-cert
{{- end }}
  name: {{ include "aws-load-balancer-controller.namePrefix" . }}-webhook
  labels:
    {{- include "aws-load-balancer-controller.labels" . | nindent 4 }}
webhooks:
  - clientConfig:
      caBundle: {{ if not $.Values.enableCertManager -}}{{ $tls.caCert }}{{- else -}}Cg=={{ end }}
      service:
        name: {{ template "aws-load-balancer-controller.webhookService" . }}
        namespace: {{ $.Release.Namespace }}
        path: /mutate-v1-pod
    failurePolicy: Fail
    name: mpod.elbv2.k8s.aws
    admissionReviewVersions:
      - v1beta1
    namespaceSelector:
      matchExpressions:
        - key: elbv2.k8s.aws/pod-readiness-gate-inject
          operator: In
          values:
            - enabled
    objectSelector:
      matchExpressions:
        - key: app.kubernetes.io/name
          operator: NotIn
          values:
            - {{ include "aws-load-balancer-controller.name" . }}
    {{- if .Values.objectSelector.matchExpressions }}
    {{- toYaml .Values.objectSelector.matchExpressions | nindent 4 }}
    {{- end }}
    {{- if .Values.objectSelector.matchLabels }}
      matchLabels:
    {{- toYaml .Values.objectSelector.matchLabels | nindent 6 }}
    {{- end }}
    rules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
        resources:
          - pods
    sideEffects: None
  - clientConfig:
      caBundle: {{ if not $.Values.enableCertManager -}}{{ $tls.caCert }}{{- else -}}Cg=={{ end }}
      service:
        name: {{ template "aws-load-balancer-controller.webhookService" . }}
        namespace: {{ $.Release.Namespace }}
        path: /mutate-elbv2-k8s-aws-v1beta1-targetgroupbinding
    failurePolicy: Fail
    name: mtargetgroupbinding.elbv2.k8s.aws
    admissionReviewVersions:
      - v1beta1
    rules:
      - apiGroups:
          - elbv2.k8s.aws
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - targetgroupbindings
    sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
{{- if $.Values.enableCertManager }}
  annotations:
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "aws-load-balancer-controller.namePrefix" . }}-serving-cert
{{- end }}
  name: {{ include "aws-load-balancer-controller.namePrefix" . }}-webhook
  labels:
    {{- include "aws-load-balancer-controller.labels" . | nindent 4 }}
webhooks:
  - clientConfig:
      caBundle: {{ if not $.Values.enableCertManager -}}{{ $tls.caCert }}{{- else -}}Cg=={{ end }}
      service:
        name: {{ template "aws-load-balancer-controller.webhookService" . }}
        namespace: {{ $.Release.Namespace }}
        path: /validate-elbv2-k8s-aws-v1beta1-targetgroupbinding
    failurePolicy: Fail
    name: vtargetgroupbinding.elbv2.k8s.aws
    admissionReviewVersions:
      - v1beta1
    rules:
      - apiGroups:
          - elbv2.k8s.aws
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - targetgroupbindings
    sideEffects: None
  - clientConfig:
      caBundle: {{ if not $.Values.enableCertManager -}}{{ $tls.caCert }}{{- else -}}Cg=={{ end }}
      service:
        name: {{ template "aws-load-balancer-controller.webhookService" . }}
        namespace: {{ $.Release.Namespace }}
        path: /validate-networking-v1-ingress
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: vingress.elbv2.k8s.aws
    admissionReviewVersions:
      - v1beta1
    rules:
      - apiGroups:
          - networking.k8s.io
        apiVersions:
          - v1
        operations:
          - CREATE
          - UPDATE
        resources:
          - ingresses
    sideEffects: None
---
{{- if not $.Values.enableCertManager }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "aws-load-balancer-controller.webhookCertSecret" . }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "aws-load-balancer-controller.labels" . | indent 4 }}
type: kubernetes.io/tls
data:
  ca.crt: {{ $tls.caCert }}
  tls.crt: {{ $tls.clientCert }}
  tls.key: {{ $tls.clientKey }}
{{- else }}
{{- if .Capabilities.APIVersions.Has "cert-manager.io/v1" }}
apiVersion: cert-manager.io/v1
{{- else }}
apiVersion: cert-manager.io/v1alpha2
{{- end }}
kind: Certificate
metadata:
  name: {{ template "aws-load-balancer-controller.namePrefix" . }}-serving-cert
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "aws-load-balancer-controller.labels" . | indent 4 }}
spec:
  dnsNames:
    - {{ template "aws-load-balancer-controller.webhookService" . }}.{{ .Release.Namespace }}.svc
    - {{ template "aws-load-balancer-controller.webhookService" . }}.{{ .Release.Namespace }}.svc.cluster.local
  issuerRef:
    kind: Issuer
    name: {{ template "aws-load-balancer-controller.namePrefix" . }}-selfsigned-issuer
  secretName: {{ template "aws-load-balancer-controller.webhookCertSecret" . }}
---
{{- if .Capabilities.APIVersions.Has "cert-manager.io/v1" }}
apiVersion: cert-manager.io/v1
{{- else }}
apiVersion: cert-manager.io/v1alpha2
{{- end }}
kind: Issuer
metadata:
  name: {{ template "aws-load-balancer-controller.namePrefix" . }}-selfsigned-issuer
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "aws-load-balancer-controller.labels" . | indent 4 }}
spec:
  selfSigned: {}
{{- end }}