devops-infra-helm-charts-gcp/helm-templates/opentelemetry-operator/templates/admission-webhooks/operator-webhook-with-cert-manager.yaml

{{- if and (.Values.admissionWebhooks.create) (.Values.admissionWebhooks.certManager.enabled) }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: {{ include "opentelemetry-operator.webhookCertAnnotation" . }}
  labels:
    {{- include "opentelemetry-operator.labels" . | nindent 4 }}
    app.kubernetes.io/component: webhook
  name: {{ template "opentelemetry-operator.MutatingWebhookName" . }}-mutation
webhooks:
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /mutate-opentelemetry-io-v1alpha1-instrumentation
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
    name: minstrumentation.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
    - apiGroups:
        - opentelemetry.io
      apiVersions:
        - v1alpha1
      operations:
        - CREATE
        - UPDATE
      resources:
        - instrumentations
      scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /mutate-opentelemetry-io-v1beta1-opentelemetrycollector
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
    name: mopentelemetrycollectorbeta.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
      - apiGroups:
          - opentelemetry.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - opentelemetrycollectors
        scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /mutate-v1-pod
        port: {{ .Values.admissionWebhooks.servicePort }}
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    failurePolicy: {{ .Values.admissionWebhooks.pods.failurePolicy }}
    name: mpod.kb.io
    rules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
        resources:
          - pods
        scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: {{ include "opentelemetry-operator.webhookCertAnnotation" . }}
  labels:
    {{- include "opentelemetry-operator.labels" . | nindent 4 }}
    app.kubernetes.io/component: webhook
  name: {{ template "opentelemetry-operator.fullname" . }}-validation
webhooks:
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validate-opentelemetry-io-v1alpha1-instrumentation
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
    name: vinstrumentationcreateupdate.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
    - apiGroups:
        - opentelemetry.io
      apiVersions:
        - v1alpha1
      operations:
        - CREATE
        - UPDATE
      resources:
        - instrumentations
      scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validate-opentelemetry-io-v1alpha1-instrumentation
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy: Ignore
    name: vinstrumentationdelete.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
      - apiGroups:
          - opentelemetry.io
        apiVersions:
          - v1alpha1
        operations:
          - DELETE
        resources:
          - instrumentations
        scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validate-opentelemetry-io-v1beta1-opentelemetrycollector
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
    name: vopentelemetrycollectorcreateupdatebeta.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
      - apiGroups:
          - opentelemetry.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - opentelemetrycollectors
        scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        name: {{ template "opentelemetry-operator.fullname" . }}-webhook
        namespace: {{ .Release.Namespace }}
        path: /validate-opentelemetry-io-v1beta1-opentelemetrycollector
        port: {{ .Values.admissionWebhooks.servicePort }}
    failurePolicy: Ignore
    name: vopentelemetrycollectordeletebeta.kb.io
    {{- if .Values.admissionWebhooks.namespaceSelector }}
    namespaceSelector:
    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
    {{- end }}
    {{- if .Values.admissionWebhooks.objectSelector }}
    objectSelector:
    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
    {{- end }}
    rules:
      - apiGroups:
          - opentelemetry.io
        apiVersions:
          - v1beta1
        operations:
          - DELETE
        resources:
          - opentelemetrycollectors
        scope: Namespaced
    sideEffects: None
    timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
{{- end }}