{{- if eq .Values.certManager.enable true -}}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "telegraf-operator.fullname" . }}"
  labels:
    {{- include "telegraf-operator.labels" . | nindent 4 }}
  name: {{ include "telegraf-operator.fullname" . }}
webhooks:
- clientConfig:
    service:
      name: {{ include "telegraf-operator.fullname" . }}
      namespace: {{ .Release.Namespace }}
      path: /mutate-v1-pod
  failurePolicy: Ignore
  sideEffects: None
  admissionReviewVersions:
  - 'v1'
  name: telegraf.influxdata.com
  {{- if .Values.webhook.excludeNamespaces }}
  namespaceSelector:
    matchExpressions:
    - key: kubernetes.io/metadata.name
      operator: NotIn
      values:
      {{- range .Values.webhook.excludeNamespaces }}
      - {{ . | quote }}
      {{- end }}
  {{- end }}
  rules:
  - apiGroups:
    - '*'
    apiVersions:
    - '*'
    operations:
    - CREATE
    - DELETE
    resources:
    - pods
{{- end }}