netbird-kubernetes-operator/helm/kubernetes-operator/templates/webhook.yaml

{{ $tls := fromYaml ( include "kubernetes-operator.webhookCerts" . ) }}
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
{{- if $.Values.webhook.enableCertManager }}
  annotations:
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert
{{- end }}
  name: {{ include "kubernetes-operator.fullname" . }}-mpod-webhook
  labels:
    {{- include "kubernetes-operator.labels" . | nindent 4 }}
webhooks:
- clientConfig:
    {{- if not $.Values.webhook.enableCertManager }}
    caBundle: {{ $tls.caCert }}
    {{ end }}
    service:
      name: {{ template "kubernetes-operator.webhookService" . }}
      namespace: {{ $.Release.Namespace }}
      path: /mutate--v1-pod
  failurePolicy: {{ .Values.webhook.failurePolicy }}
  name: mpod-v1.netbird.io
  admissionReviewVersions:
  - v1
  {{- if .Values.webhook.namespaceSelectors }}
  namespaceSelector:
    matchExpressions:
    {{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }}
  {{ end }}
  objectSelector:
    matchExpressions:
    - key: app.kubernetes.io/name
      operator: NotIn
      values:
      - {{ include "kubernetes-operator.name" . }}
    {{- if .Values.webhook.objectSelector.matchExpressions }}
    {{- toYaml .Values.webhook.objectSelector.matchExpressions | nindent 4 }}
    {{- end }}
    {{- if .Values.webhook.objectSelector.matchLabels }}
    matchLabels:
    {{- toYaml .Values.webhook.objectSelector.matchLabels | nindent 6 }}
    {{- end }}
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
  sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
{{- if $.Values.webhook.enableCertManager }}
  annotations:
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert
{{- end }}
  name: {{ include "kubernetes-operator.fullname" . }}-vnbsetupkey-webhook
  labels:
    {{- include "kubernetes-operator.labels" . | nindent 4 }}
webhooks:
- clientConfig:
    {{- if not $.Values.webhook.enableCertManager }}
    caBundle: {{ $tls.caCert }}
    {{ end }}
    service:
      name: {{ template "kubernetes-operator.webhookService" . }}
      namespace: {{ $.Release.Namespace }}
      path: /validate-netbird-io-v1-nbsetupkey
  failurePolicy: {{ .Values.webhook.failurePolicy }}
  name: vnbsetupkey-v1.netbird.io
  admissionReviewVersions:
  - v1
  {{- if .Values.webhook.namespaceSelectors }}
  namespaceSelector:
    matchExpressions:
    {{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }}
  {{ end }}
  rules:
  - apiGroups:
    - netbird.io
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - "nbsetupkeys"
  sideEffects: None
{{- if and $.Values.ingress.enabled (or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret) }}
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
{{- if $.Values.webhook.enableCertManager }}
  annotations:
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert
{{- end }}
  name: {{ include "kubernetes-operator.fullname" . }}-vnbgroup-webhook
  labels:
    {{- include "kubernetes-operator.labels" . | nindent 4 }}
webhooks:
- clientConfig:
    {{- if not $.Values.webhook.enableCertManager }}
    caBundle: {{ $tls.caCert }}
    {{ end }}
    service:
      name: {{ template "kubernetes-operator.webhookService" . }}
      namespace: {{ $.Release.Namespace }}
      path: /validate-netbird-io-v1-nbgroup
  failurePolicy: {{ .Values.webhook.failurePolicy }}
  name: vnbgroup-v1.netbird.io
  admissionReviewVersions:
  - v1
  {{- if .Values.webhook.namespaceSelectors }}
  namespaceSelector:
    matchExpressions:
    {{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }}
  {{ end }}
  rules:
  - apiGroups:
    - netbird.io
    apiVersions:
    - v1
    operations:
    - DELETE
    resources:
    - "nbgroups"
  sideEffects: None
{{- end }}
---
{{- if not $.Values.webhook.enableCertManager }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "kubernetes-operator.webhookCertSecret" . }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "kubernetes-operator.labels" . | indent 4 }}
type: kubernetes.io/tls
data:
  ca.crt: {{ $tls.caCert }}
  tls.crt: {{ $tls.clientCert }}
  tls.key: {{ $tls.clientKey }}
{{- else }}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ template "kubernetes-operator.fullname" . }}-serving-cert
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "kubernetes-operator.labels" . | indent 4 }}
spec:
  dnsNames:
  - {{ template "kubernetes-operator.webhookService" . }}.{{ .Release.Namespace }}.svc
  - {{ template "kubernetes-operator.webhookService" . }}.{{ .Release.Namespace }}.{{ .Values.cluster.dns }}
  issuerRef:
    kind: Issuer
    name: {{ template "kubernetes-operator.fullname" . }}-selfsigned-issuer
  secretName: {{ template "kubernetes-operator.webhookCertSecret" . }}
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: {{ template "kubernetes-operator.fullname" . }}-selfsigned-issuer
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "kubernetes-operator.labels" . | indent 4 }}
spec:
  selfSigned: {}
{{- end }}