apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: lifecycle-mutating-webhook-configuration
{{- $caAnnotations := .Values.global.caInjectionAnnotations}}
{{- $annotations := include "common.annotations" (dict "context" .) }}
{{- if or $caAnnotations $annotations }}
  annotations:
    {{- with $annotations  }}
    {{- . -}}
    {{- end }}
    {{- with $caAnnotations  }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
{{- end }}
  labels:
    keptn.sh/inject-cert: "true"
    app.kubernetes.io/part-of: "keptn"
{{- include "common.labels.standard" ( dict "context" . ) | nindent 4 }}
webhooks:
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: 'lifecycle-webhook-service'
      namespace: '{{ .Release.Namespace }}'
      path: /mutate-v1-pod
  failurePolicy: {{ .Values.failurePolicy | default "Fail" }}
  name: mpod.keptn.sh
  namespaceSelector:
    matchExpressions:
    - key: control-plane
      operator: NotIn
      values:
      - lifecycle-operator
{{- if eq (len .Values.allowedNamespaces) 0 }}
    - key: kubernetes.io/metadata.name
      operator: NotIn
      values:  {{ .Values.deniedNamespaces | default list | toJson }}
{{- else }}
    - key: kubernetes.io/metadata.name
      operator: In
      values: {{ .Values.allowedNamespaces | default list | toJson }}
{{- end }}
    - key: kubernetes.io/metadata.name
      operator: NotIn
      values:
      - '{{ .Release.Namespace }}'
      - kube-system
      - kube-public
      - kube-node-lease
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - pods
  sideEffects: None
