{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}

{{- /* This uses a fixed name due to upstream logic (https://github.com/envoyproxy/gateway/blob/fba09dc13117e95dfcdb00c6d1a3316b8431a709/internal/cmd/certgen.go#L38) */ -}}
{{- if .Values.topologyInjector.enabled }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: 'envoy-gateway-topology-injector.{{ include "common.names.namespace" . }}'
  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.topologyInjector.annotations .Values.commonAnnotations "context" $ ) | nindent 4 }}
  labels:
    app.kubernetes.io/component: topology-injector
    {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
webhooks:
  - name: topology.webhook.gateway.envoyproxy.io
    admissionReviewVersions: ["v1"]
    sideEffects: None
    clientConfig:
      service:
        name: {{ include "common.names.fullname" . }}
        namespace: {{ include "common.names.namespace" . | quote }}
        path: "/inject-pod-topology"
        port: 9443
    failurePolicy: Ignore
    rules:
      - operations: ["CREATE"]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods/binding"]
    namespaceSelector:
      matchExpressions:
        - key: kubernetes.io/metadata.name
          operator: In
          values:
            - {{ include "common.names.namespace" . | quote }}
{{- end }}