{{- if .Values.webhooks.register }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: kargo
  labels:
    {{- include "kargo.labels" . | nindent 4 }}
    {{- include "kargo.controller.labels" . | nindent 4 }}
  annotations:
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/kargo-webhooks-server
webhooks:
- name: freight.kargo.akuity.io
  admissionReviewVersions: ["v1"]
  sideEffects: None
  clientConfig:
    service:
      namespace: {{ .Release.Namespace }}
      name: kargo-webhooks-server
      path: /mutate-kargo-akuity-io-v1alpha1-freight
  rules:
  - scope: Namespaced
    apiGroups: ["kargo.akuity.io"]
    apiVersions: ["v1alpha1"]
    resources: ["freights"]
    operations: ["CREATE", "UPDATE"]
  failurePolicy: Fail
- name: promotion.kargo.akuity.io
  admissionReviewVersions: ["v1"]
  sideEffects: None
  clientConfig:
    service:
      namespace: {{ .Release.Namespace }}
      name: kargo-webhooks-server
      path: /mutate-kargo-akuity-io-v1alpha1-promotion
  rules:
  - scope: Namespaced
    apiGroups: ["kargo.akuity.io"]
    apiVersions: ["v1alpha1"]
    resources: ["promotions"]
    operations: ["CREATE", "UPDATE"]
  failurePolicy: Fail
- name: stage.kargo.akuity.io
  admissionReviewVersions: ["v1"]
  sideEffects: None
  clientConfig:
    service:
      namespace: {{ .Release.Namespace }}
      name: kargo-webhooks-server
      path: /mutate-kargo-akuity-io-v1alpha1-stage
  rules:
  - scope: Namespaced
    apiGroups: ["kargo.akuity.io"]
    apiVersions: ["v1alpha1"]
    resources: ["stages"]
    operations: ["CREATE", "UPDATE"]
  failurePolicy: Fail
- name: warehouse.kargo.akuity.io
  admissionReviewVersions: ["v1"]
  sideEffects: None
  clientConfig:
    service:
      namespace: {{ .Release.Namespace }}
      name: kargo-webhooks-server
      path: /mutate-kargo-akuity-io-v1alpha1-warehouse
  rules:
  - scope: Namespaced
    apiGroups: ["kargo.akuity.io"]
    apiVersions: ["v1alpha1"]
    resources: ["warehouses"]
    operations: ["CREATE", "UPDATE"]
  failurePolicy: Fail
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: kargo
  labels:
    {{- include "kargo.labels" . | nindent 4 }}
    {{- include "kargo.controller.labels" . | nindent 4 }}
  annotations:
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/kargo-webhooks-server
webhooks:
- name: freight.kargo.akuity.io
  admissionReviewVersions: ["v1"]
  sideEffects: None
  clientConfig:
    service:
      namespace: {{ .Release.Namespace }}
      name: kargo-webhooks-server
      path: /validate-kargo-akuity-io-v1alpha1-freight
  rules:
  - scope: Namespaced
    apiGroups: ["kargo.akuity.io"]
    apiVersions: ["v1alpha1"]
    resources: ["freights", "freights/status"]
    operations: ["CREATE", "UPDATE", "DELETE"]
  failurePolicy: Fail
- name: project.kargo.akuity.io
  admissionReviewVersions: ["v1"]
  sideEffects: NoneOnDryRun
  clientConfig:
    service:
      namespace: {{ .Release.Namespace }}
      name: kargo-webhooks-server
      path: /validate-kargo-akuity-io-v1alpha1-project
  rules:
  - scope: Cluster
    apiGroups: ["kargo.akuity.io"]
    apiVersions: ["v1alpha1"]
    resources: ["projects"]
    operations: ["CREATE"]
  failurePolicy: Fail
- name: promotion.kargo.akuity.io
  admissionReviewVersions: ["v1"]
  sideEffects: None
  clientConfig:
    service:
      namespace: {{ .Release.Namespace }}
      name: kargo-webhooks-server
      path: /validate-kargo-akuity-io-v1alpha1-promotion
  rules:
  - scope: Namespaced
    apiGroups: ["kargo.akuity.io"]
    apiVersions: ["v1alpha1"]
    resources: ["promotions"]
    operations: ["CREATE", "UPDATE", "DELETE"]
  failurePolicy: Fail
- name: stage.kargo.akuity.io
  admissionReviewVersions: ["v1"]
  sideEffects: None
  clientConfig:
    service:
      namespace: {{ .Release.Namespace }}
      name: kargo-webhooks-server
      path: /validate-kargo-akuity-io-v1alpha1-stage
  rules:
  - scope: Namespaced
    apiGroups: ["kargo.akuity.io"]
    apiVersions: ["v1alpha1"]
    resources: ["stages"]
    operations: ["CREATE", "UPDATE"]
  failurePolicy: Fail
- name: warehouse.kargo.akuity.io
  admissionReviewVersions: ["v1"]
  sideEffects: None
  clientConfig:
    service:
      namespace: {{ .Release.Namespace }}
      name: kargo-webhooks-server
      path: /validate-kargo-akuity-io-v1alpha1-warehouse
  rules:
  - scope: Namespaced
    apiGroups: ["kargo.akuity.io"]
    apiVersions: ["v1alpha1"]
    resources: ["warehouses"]
    operations: ["CREATE", "UPDATE"]
  failurePolicy: Fail
{{- end }}
