# grafana_charts_pod-eviction-webhook.yaml
{{- if .Values.webhooks.enabled -}}
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: pod-eviction-{{ .Release.Namespace }}
  labels:
    grafana.com/inject-rollout-operator-ca: "true"
    grafana.com/namespace: {{ .Release.Namespace | quote }}
    {{- include "rollout-operator.labels" . | nindent 4 }}
webhooks:
  - name: pod-eviction-{{ .Release.Namespace }}.grafana.com
    clientConfig:
      service:
        namespace: {{ .Release.Namespace | quote }}
        name: {{ include "rollout-operator.fullname" . }}
        path: /admission/pod-eviction
        port: 443
    rules:
      - operations:
          - CREATE
        apiGroups:
          - ""
        apiVersions:
          - v1
        resources:
          - pods/eviction
        scope: Namespaced
    admissionReviewVersions:
      - v1
    {{- if not (kindIs "invalid" .Values.namespaceSelector) }}
    namespaceSelector:
      {{- if .Values.namespaceSelector.matchLabels }}
      matchLabels:
        {{- toYaml .Values.namespaceSelector.matchLabels | nindent 8 }}
      {{- else }}
      matchLabels:
        kubernetes.io/metadata.name: {{ .Release.Namespace | quote }}
      {{- end }}
      {{- with .Values.namespaceSelector.matchExpressions }}
      matchExpressions:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    {{- end }}
    {{- with .Values.webhooks.objectSelector }}
    objectSelector:
      {{- toYaml . | nindent 6 }}
    {{- end }}
    sideEffects: None
    timeoutSeconds: {{.Values.webhooks.timeoutSeconds}}
    failurePolicy: {{.Values.webhooks.failurePolicy}}
{{- end -}}