{{- $ca := genCA "pod-preset-webhook-ca" 3650 }}
{{- $cn := printf "%s-webhook" (include "pod-preset.fullname" .) }}
{{- $altName1 := printf "%s.%s" $cn .Release.Namespace }}
{{- $altName2 := printf "%s.%s.svc" $cn .Release.Namespace }}
{{- $cert := genSignedCert $cn nil (list $altName1 $altName2) 3650 $ca }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: {{ template "pod-preset.fullname" . }}-webhook
  namespace: "{{ .Release.Namespace }}"
webhooks:
- clientConfig:
    caBundle: {{ b64enc $ca.Cert }}
    service:
      name: {{ template "pod-preset.fullname" . }}-webhook
      namespace: "{{ .Release.Namespace }}"
      path: /mutating-pods
  failurePolicy: Ignore
  name: podpresets.settings.svcat.k8s.io
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
  namespaceSelector:
    matchExpressions:
    - key: gardener.cloud/purpose
      operator: NotIn
      values:
      - kube-system
  timeoutSeconds: {{ .Values.webhook.timeout }}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "pod-preset.fullname" . }}-webhook-cert
  namespace: "{{ .Release.Namespace }}"
type: Opaque
data:
  tls.crt: {{ b64enc $cert.Cert }}
  tls.key: {{ b64enc $cert.Key }}
