{{- if .Values.operator.enabled }}
{{- $ca := genCA "kube-events-admission-ca" 3650 }}
{{- $cn := ( include "kube-events.admission.fullname" . ) }}
{{- $altName1 := printf "%s.%s" ( include "kube-events.admission.fullname" . ) (include "kube-events.namespace" .) }}
{{- $altName2 := printf "%s.%s.svc" ( include "kube-events.admission.fullname" . ) (include "kube-events.namespace" .) }}
{{- $cert := genSignedCert $cn nil (list $altName1 $altName2) 3650 $ca -}}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "kube-events.admission.fullname" . }}
  namespace: {{ template "kube-events.namespace" . }}
  labels:
{{ include "kube-events.labels" . | indent 4 }}
type: Opaque
data:
  tls.crt: {{ b64enc $cert.Cert }}
  tls.key: {{ b64enc $cert.Key }}
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: {{ template "kube-events.admission.fullname" . }}-mutate
  labels:
{{ include "kube-events.labels" . | indent 4 }}
webhooks:
  - admissionReviewVersions:
      - v1beta1
    clientConfig:
      caBundle: {{ b64enc $ca.Cert }}
      service:
        name: {{ template "kube-events.admission.fullname" . }}
        namespace: {{ template "kube-events.namespace" . }}
        path: /mutate-events-kubesphere-io-v1alpha1-rule
    failurePolicy: Fail
    name: mrule.kb.io
    rules:
      - apiGroups:
          - events.kubesphere.io
        apiVersions:
          - v1alpha1
        operations:
          - CREATE
          - UPDATE
        resources:
          - rules
    sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: {{ template "kube-events.admission.fullname" . }}-validate
  labels:
{{ include "kube-events.labels" . | indent 4 }}
webhooks:
  - admissionReviewVersions:
      - v1beta1
    clientConfig:
      caBundle: {{ b64enc $ca.Cert }}
      service:
        name: {{ template "kube-events.admission.fullname" . }}
        namespace: {{ template "kube-events.namespace" . }}
        path: /validate-events-kubesphere-io-v1alpha1-rule
    failurePolicy: Fail
    name: vrule.kb.io
    rules:
      - apiGroups:
          - events.kubesphere.io
        apiVersions:
          - v1alpha1
        operations:
          - CREATE
          - UPDATE
        resources:
          - rules
    sideEffects: None
---
apiVersion: v1
kind: Service
metadata:
  name: {{ template "kube-events.admission.fullname" . }}
  namespace: {{ template "kube-events.namespace" . }}
  labels:
{{ include "kube-events.labels" . | indent 4 }}
spec:
  ports:
    - port: 443
      targetPort: 9443
  selector:
    app: {{ template "kube-events.operator.fullname" . }}
{{ include "kube-events.labels" . | indent 4 }}

{{- end }}