{{- if .Values.operator.admissionController.enable }}
apiVersion: v1
kind: Service
metadata:
  name: {{ include "maintenance-operator.fullname" . }}-webhook-service
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/component: webhook
    app.kubernetes.io/created-by: maintenance-operator
    app.kubernetes.io/part-of: maintenance-operator
  {{- include "maintenance-operator.labels" . | nindent 4 }}
spec:
  type: {{ .Values.webhookService.type }}
  selector:
    control-plane: {{ .Release.Name }}-controller-manager
  {{- include "maintenance-operator.selectorLabels" . | nindent 4 }}
  ports:
	{{- .Values.webhookService.ports | toYaml | nindent 2 }}
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: {{ include "maintenance-operator.fullname" . }}-validating-webhook-configuration
  annotations:
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "maintenance-operator.fullname" . }}-serving-cert
  labels:
  {{- include "maintenance-operator.labels" . | nindent 4 }}
webhooks:
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: '{{ include "maintenance-operator.fullname" . }}-webhook-service'
      namespace: {{ .Release.Namespace }}
      path: /validate-maintenance-nvidia-com-v1alpha1-nodemaintenance
  failurePolicy: Fail
  name: vnodemaintenance.kb.io
  rules:
  - apiGroups:
    - maintenance.nvidia.com
    apiVersions:
    - v1alpha1
    operations:
    - CREATE
    resources:
    - nodemaintenances
  sideEffects: None
{{- end }}