{{- if and (.Values.admissionWebhooks.create) (not .Values.admissionWebhooks.certManager.enabled) }}
{{- $cert := fromYaml (include "opentelemetry-operator.WebhookCert" .) }}
{{- $caCertEnc := $cert.ca }}
{{- $certCrtEnc := $cert.crt }}
{{- $certKeyEnc := $cert.key }}
apiVersion: v1
kind: Secret
type: kubernetes.io/tls
metadata:
  annotations:
    "helm.sh/hook": "pre-install,pre-upgrade"
    "helm.sh/hook-delete-policy": "before-hook-creation"
    {{- if .Values.admissionWebhooks.secretAnnotations }}
    {{- toYaml .Values.admissionWebhooks.secretAnnotations | nindent 4 }}
    {{- end }}
  labels:
    {{- include "opentelemetry-operator.labels" . | nindent 4 }}
    app.kubernetes.io/component: webhook
    {{- if .Values.admissionWebhooks.secretLabels }}
    {{- toYaml .Values.admissionWebhooks.secretLabels | nindent 4 }}
    {{- end }}
  name: {{ default (printf "%s-controller-manager-service-cert" (include "opentelemetry-operator.fullname" .)) .Values.admissionWebhooks.secretName }}
  namespace: {{ .Release.Namespace }}
data:
  tls.crt: {{ $certCrtEnc }}
  tls.key: {{ $certKeyEnc }}
  ca.crt: {{ $caCertEnc }}
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  labels:
    {{- include "opentelemetry-operator.labels" . | nindent 4 }}
    app.kubernetes.io/component: webhook
  name: {{ template "opentelemetry-operator.MutatingWebhookName" . }}-mutation
webhooks:
  - admissionReviewVersions:
      - v1
    clientConfig:
      caBundle: {{ $caCertEnc }}
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /mutate-opentelemetry-io-v1alpha1-instrumentation
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
    name: minstrumentation.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
    - apiGroups:
        - opentelemetry.io
      apiVersions:
        - v1alpha1
      operations:
        - CREATE
        - UPDATE
      resources:
        - instrumentations
      scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
  - admissionReviewVersions:
      - v1
    clientConfig:
      caBundle: {{ $caCertEnc }}
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /mutate-opentelemetry-io-v1beta1-opentelemetrycollector
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
    name: mopentelemetrycollectorbeta.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
      - apiGroups:
          - opentelemetry.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - opentelemetrycollectors
        scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
  - admissionReviewVersions:
      - v1
    clientConfig:
      caBundle: {{ $caCertEnc }}
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /mutate-v1-pod
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy: {{ .Values.admissionWebhooks.pods.failurePolicy }}
    name: mpod.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
        resources:
          - pods
        scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: {{ include "opentelemetry-operator.webhookCertAnnotation" . }}
  labels:
    {{- include "opentelemetry-operator.labels" . | nindent 4 }}
    app.kubernetes.io/component: webhook
  name: {{ template "opentelemetry-operator.fullname" . }}-validation
webhooks:
  - admissionReviewVersions:
      - v1
    clientConfig:
      caBundle: {{ $caCertEnc }}
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validate-opentelemetry-io-v1alpha1-instrumentation
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy:  {{ .Values.admissionWebhooks.failurePolicy }}
    name: vinstrumentationcreateupdate.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
    - apiGroups:
        - opentelemetry.io
      apiVersions:
        - v1alpha1
      operations:
        - CREATE
        - UPDATE
      resources:
        - instrumentations
      scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
  - admissionReviewVersions:
      - v1
    clientConfig:
      caBundle: {{ $caCertEnc }}
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validate-opentelemetry-io-v1alpha1-instrumentation
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy: Ignore
    name: vinstrumentationdelete.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
      - apiGroups:
          - opentelemetry.io
        apiVersions:
          - v1alpha1
        operations:
          - DELETE
        resources:
          - instrumentations
        scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
  - admissionReviewVersions:
      - v1
    clientConfig:
      caBundle: {{ $caCertEnc }}
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validate-opentelemetry-io-v1beta1-opentelemetrycollector
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
    name: vopentelemetrycollectorcreateupdatebeta.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
      - apiGroups:
          - opentelemetry.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - opentelemetrycollectors
        scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
  - admissionReviewVersions:
      - v1
    clientConfig:
      caBundle: {{ $caCertEnc }}
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validate-opentelemetry-io-v1beta1-opentelemetrycollector
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy: Ignore
    name: vopentelemetrycollectordeletebeta.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
      - apiGroups:
          - opentelemetry.io
        apiVersions:
          - v1beta1
        operations:
          - DELETE
        resources:
          - opentelemetrycollectors
        scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
---
{{- $contextWithCaBundle := merge $ (dict "caBundle" $caCertEnc) }}
{{- tpl (.Files.Get "conf/crds/crd-opentelemetry.io_opampbridges.yaml") $contextWithCaBundle }}
---
{{- tpl (.Files.Get "conf/crds/crd-opentelemetrycollector.yaml") $contextWithCaBundle }}
---
{{- tpl (.Files.Get "conf/crds/crd-opentelemetryinstrumentation.yaml") $contextWithCaBundle }}
{{- else }}
{{- tpl (.Files.Get "conf/crds/crd-opentelemetry.io_opampbridges.yaml") . }}
---
{{- tpl (.Files.Get "conf/crds/crd-opentelemetrycollector.yaml") . }}
---
{{- tpl (.Files.Get "conf/crds/crd-opentelemetryinstrumentation.yaml") . }}
{{- end }}