# Check if the TLS secret already exists and initialize variables for later use at the top level
{{- $secret := lookup "v1" "Secret" .Release.Namespace (include "piraeus-operator.certifcateName" .) }}
{{ $ca := "" }}
{{ $key := "" }}
{{ $crt := "" }}
{{- if .Values.tls.certManagerIssuerRef }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ include "piraeus-operator.fullname" . }}
  labels:
  {{- include "piraeus-operator.labels" . | nindent 4 }}
spec:
  secretName: {{ include "piraeus-operator.certifcateName" . }}
  dnsNames:
    - {{ include "piraeus-operator.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc
  issuerRef:
  {{- toYaml .Values.tls.certManagerIssuerRef | nindent 4 }}
  privateKey:
    rotationPolicy: Always
---
{{- else if .Values.tls.autogenerate }}
  {{- if and $secret (not .Values.tls.renew) }}
    {{- $ca = get $secret.data "ca.crt" }}
    {{- $key = get $secret.data "tls.key" }}
    {{- $crt = get $secret.data "tls.crt" }}
  {{- else }}
    {{- $serviceName := (printf "%s-webhook-service.%s.svc" (include "piraeus-operator.fullname" .) .Release.Namespace)}}
    {{- $cert := genSelfSignedCert $serviceName nil (list $serviceName) 3650 }}
    {{- $ca = b64enc $cert.Cert }}
    {{- $key = b64enc $cert.Key }}
    {{- $crt = b64enc $cert.Cert }}
  {{- end }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "piraeus-operator.certifcateName" . }}
  labels:
    {{- include "piraeus-operator.labels" . | nindent 4 }}
type: kubernetes.io/tls
data:
  ca.crt: {{ $ca }}
  tls.key: {{ $key }}
  tls.crt: {{ $crt }}
{{- end }}
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: {{ include "piraeus-operator.fullname" . }}-validating-webhook-configuration
  labels:
    {{- include "piraeus-operator.labels" . | nindent 4 }}
  {{- if .Values.tls.certManagerIssuerRef }}
  annotations:
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "piraeus-operator.fullname" . }}
  {{- end }}
webhooks:
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: '{{ include "piraeus-operator.fullname" . }}-webhook-service'
      namespace: '{{ .Release.Namespace }}'
      path: /validate-piraeus-io-v1-linstorcluster
    {{- if not .Values.tls.certManagerIssuerRef }}
    caBundle: {{ $ca }}
    {{- end }}
  failurePolicy: {{ .Values.webhook.failurePolicy }}
  timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}
  name: vlinstorcluster.kb.io
  rules:
  - apiGroups:
    - piraeus.io
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - linstorclusters
  sideEffects: None
- admissionReviewVersions:
    - v1
  clientConfig:
    service:
      name: '{{ include "piraeus-operator.fullname" . }}-webhook-service'
      namespace: '{{ .Release.Namespace }}'
      path: /validate-piraeus-io-v1-linstornodeconnection
    {{- if not .Values.tls.certManagerIssuerRef }}
    caBundle: {{ $ca }}
    {{- end }}
  failurePolicy: {{ .Values.webhook.failurePolicy }}
  timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}
  name: vlinstornodeconnection.kb.io
  rules:
    - apiGroups:
        - piraeus.io
      apiVersions:
        - v1
      operations:
        - CREATE
        - UPDATE
      resources:
        - linstornodeconnections
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: '{{ include "piraeus-operator.fullname" . }}-webhook-service'
      namespace: '{{ .Release.Namespace }}'
      path: /validate-piraeus-io-v1-linstorsatellite
    {{- if not .Values.tls.certManagerIssuerRef }}
    caBundle: {{ $ca }}
    {{- end }}
  failurePolicy: {{ .Values.webhook.failurePolicy }}
  timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}
  name: vlinstorsatellite.kb.io
  rules:
  - apiGroups:
    - piraeus.io
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - linstorsatellites
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: '{{ include "piraeus-operator.fullname" . }}-webhook-service'
      namespace: '{{ .Release.Namespace }}'
      path: /validate-piraeus-io-v1-linstorsatelliteconfiguration
    {{- if not .Values.tls.certManagerIssuerRef }}
    caBundle: {{ $ca }}
    {{- end }}
  failurePolicy: {{ .Values.webhook.failurePolicy }}
  timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}
  name: vlinstorsatelliteconfiguration.kb.io
  rules:
  - apiGroups:
    - piraeus.io
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - linstorsatelliteconfigurations
  sideEffects: None
- admissionReviewVersions:
    - v1
  clientConfig:
    service:
      name: '{{ include "piraeus-operator.fullname" . }}-webhook-service'
      namespace: '{{ .Release.Namespace }}'
      path: /validate-storage-k8s-io-v1-storageclass
    {{- if not .Values.tls.certManagerIssuerRef }}
    caBundle: {{ $ca }}
    {{- end }}
  failurePolicy: {{ .Values.webhook.failurePolicy }}
  timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}
  name: vstorageclass.kb.io
  rules:
    - apiGroups:
        - storage.k8s.io
      apiVersions:
        - v1
      operations:
        - CREATE
        - UPDATE
      resources:
        - storageclasses
  sideEffects: None
