apiVersion: v1
kind: Service
metadata:
  name: {{ include "trust-manager.name" . }}
  namespace: {{ include "trust-manager.namespace" . }}
  labels:
    app: {{ include "trust-manager.name" . }}
    {{- include "trust-manager.labels" . | nindent 4 }}
spec:
  type: {{ .Values.app.webhook.service.type }}
  ports:
    - port: 443
      targetPort: {{ .Values.app.webhook.port }}
{{- if .Values.app.webhook.service.nodePort }}
      nodePort: {{ .Values.app.webhook.service.nodePort }}
{{- end }}
      protocol: TCP
      name: webhook
  selector:
    app: {{ include "trust-manager.name" . }}
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: {{ include "trust-manager.name" . }}
  labels:
    app: {{ include "trust-manager.name" . }}
    {{- include "trust-manager.labels" . | nindent 4 }}
  annotations:
    cert-manager.io/inject-ca-from: "{{ include "trust-manager.namespace" . }}/{{ include "trust-manager.name" . }}"
    #################### BEGIN CHANGE ####################
    {{- if .Values.app.webhook.validatingWebhookConfigurationAnnotations }}
    {{- toYaml .Values.app.webhook.validatingWebhookConfigurationAnnotations | nindent 4 }}
    {{- end }}
    ##################### END CHANGE #####################
webhooks:
  - name: trust.cert-manager.io
    rules:
      - apiGroups:
          - "trust.cert-manager.io"
        apiVersions:
          - "*"
        operations:
          - CREATE
          - UPDATE
        resources:
          - "*/*"
    admissionReviewVersions: ["v1"]
    timeoutSeconds: {{ .Values.app.webhook.timeoutSeconds }}
    failurePolicy: Fail
    sideEffects: None
    clientConfig:
      service:
        name: {{ include "trust-manager.name" . }}
        namespace: {{ include "trust-manager.namespace" . }}
        path: /validate-trust-cert-manager-io-v1alpha1-bundle
