{{<- define "default_extra_resources" >}}
rules:
  ## these permissions are so that kyverno can generate resources within profile namespaces
  - apiGroups: [ "" ]
    resources: [ "services" ]
  - apiGroups: [ "apps" ]
    resources: [ "deployments" ]
  - apiGroups: [ "security.istio.io" ]
    resources: [ "authorizationpolicies" ]
  - apiGroups: [ "networking.istio.io" ]
    resources: [ "destinationrules" ]
  ## there permissions are so that kyverno can mutate these resources for automatic restarts on secret changes
  - apiGroups: [ "apps" ]
    resources: [ "statefulsets" ]
  {{<- if .Values.kubeflow_tools.poddefaults_webhook.enabled >}}
  ## these permissions are needed for the automatic creation of PodDefaults
  - apiGroups: [ "kubeflow.org" ]
    resources: [ "poddefaults" ]
  {{<- end >}}
{{<- end >}}
{{<- $extra_resources := ((tmpl.Exec "default_extra_resources" .) | yaml).rules >}}
{{<- range $rule := .Values.deploykf_dependencies.kyverno.extraResourceRules >}}
{{<- $extra_resources = append $rule $extra_resources >}}
{{<- end ->}}


########################################
## SHARED | deploykf
########################################
deployKF:
  extraManifests:
    {{<- range $manifest := .Values.deploykf_dependencies.kyverno.extraManifests >}}
    - {{< (tpl $manifest $) | quote >}}
    {{<- end >}}

  kyverno:
    clusterPolicies:
      imagePullSecrets:
        enabled: {{< .Values.deploykf_dependencies.kyverno.clusterPolicies.imagePullSecrets.enabled | conv.ToBool >}}
        excludeNamespaces: {{< .Values.deploykf_dependencies.kyverno.clusterPolicies.imagePullSecrets.excludeNamespaces | toJSON >}}
        registryCredentials: {{< .Values.deploykf_dependencies.kyverno.clusterPolicies.imagePullSecrets.registryCredentials | toJSON >}}


########################################
## DEPENDENCY | kyverno
########################################
## as we reference the "kyverno" chart (https://kyverno.github.io/kyverno) in `dependencies` of Chart.yaml,
## we must indent our values under `kyverno:` in this file
kyverno:
  fullnameOverride: kyverno

  ## Kyverno CRDs
  crds:
    install: true
    annotations:
      ## kyverno will fail to sync if not using one of `Replace` or `ServerSideApply`
      ## https://kyverno.io/docs/installation/platform-notes/#notes-for-argocd-users
      argocd.argoproj.io/sync-options: "Replace=true"

  {{<- if .Values.kubernetes.azure.admissionsEnforcerFix >}}
  {{<- "\n" >}}
  ## Kyverno configurations
  config:
    ## azure aks admissions enforcer fix
    ## https://kyverno.io/docs/installation/platform-notes/#notes-for-aks-users
    webhookAnnotations:
      "admissions.enforcer/disabled": "true"
  {{<- end >}}

  ## Kyverno feature flags
  features:

    ## Sets the webhook failurePolicy to ignore (for the "resource" webhook only)
    forceFailurePolicyIgnore:
      ## TODO: remove once kyverno correctly removes webhooks on uninstall
      ##       https://github.com/kyverno/kyverno/issues/8390
      enabled: true

  ## A pre-delete hook to remove all Kyverno webhooks from the cluster
  webhooksCleanup:
    ## NOTE: we disable this because it is not supported by Argo CD:
    ##       https://github.com/kyverno/kyverno/issues/8390
    enabled: false

  ## Cleanup cronjobs to prevent internal resources from stacking up in the cluster
  cleanupJobs:

    admissionReports:
      enabled: true
      schedule: "*/10 * * * *"
      threshold: 10000
      image:
        registry: ""
        repository: {{< .Values.deploykf_dependencies.kyverno.images.kubectl.repository | quote >}}
        {{<- if .Values.deploykf_dependencies.kyverno.images.kubectl.tag >}}
        tag: {{< .Values.deploykf_dependencies.kyverno.images.kubectl.tag | quote >}}
        {{<- end >}}
        pullPolicy: {{< .Values.deploykf_dependencies.kyverno.images.kubectl.pullPolicy | quote >}}

    clusterAdmissionReports:
      enabled: true
      schedule: "*/10 * * * *"
      threshold: 10000
      image:
        registry: ""
        repository: {{< .Values.deploykf_dependencies.kyverno.images.kubectl.repository | quote >}}
        {{<- if .Values.deploykf_dependencies.kyverno.images.kubectl.tag >}}
        tag: {{< .Values.deploykf_dependencies.kyverno.images.kubectl.tag | quote >}}
        {{<- end >}}
        pullPolicy: {{< .Values.deploykf_dependencies.kyverno.images.kubectl.pullPolicy | quote >}}

  ## Admission controller configuration
  admissionController:
    replicas: {{< .Values.deploykf_dependencies.kyverno.admissionController.replicas | conv.ToInt >}}
    initContainer:
      image:
        registry: ""
        repository: {{< .Values.deploykf_dependencies.kyverno.images.kyvernoInit.repository | quote >}}
        {{<- if .Values.deploykf_dependencies.kyverno.images.kyvernoInit.tag >}}
        tag: {{< .Values.deploykf_dependencies.kyverno.images.kyvernoInit.tag | quote >}}
        {{<- end >}}
        pullPolicy: {{< .Values.deploykf_dependencies.kyverno.images.kyvernoInit.pullPolicy | quote >}}
    container:
      resources: {{< .Values.deploykf_dependencies.kyverno.admissionController.resources | toJSON >}}
      image:
        registry: ""
        repository: {{< .Values.deploykf_dependencies.kyverno.images.kyverno.repository | quote >}}
        {{<- if .Values.deploykf_dependencies.kyverno.images.kyverno.tag >}}
        tag: {{< .Values.deploykf_dependencies.kyverno.images.kyverno.tag | quote >}}
        {{<- end >}}
        pullPolicy: {{< .Values.deploykf_dependencies.kyverno.images.kyverno.pullPolicy | quote >}}
    rbac:
      clusterRole:
        extraResources: []

  ## Background controller configuration
  backgroundController:
    enabled: true
    replicas: {{< .Values.deploykf_dependencies.kyverno.backgroundController.replicas | conv.ToInt >}}
    resources: {{< .Values.deploykf_dependencies.kyverno.backgroundController.resources | toJSON >}}
    image:
      registry: ""
      repository: {{< .Values.deploykf_dependencies.kyverno.images.kyvernoBackgroundController.repository | quote >}}
      {{<- if .Values.deploykf_dependencies.kyverno.images.kyvernoBackgroundController.tag >}}
      tag: {{< .Values.deploykf_dependencies.kyverno.images.kyvernoBackgroundController.tag | quote >}}
      {{<- end >}}
      pullPolicy: {{< .Values.deploykf_dependencies.kyverno.images.kyvernoBackgroundController.pullPolicy | quote >}}
    rbac:
      clusterRole:
        extraResources:
          {{<- range $extra_resource := $extra_resources >}}
          - apiGroups: {{< $extra_resource.apiGroups | toJSON >}}
            resources: {{< $extra_resource.resources | toJSON >}}
            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
          {{<- end >}}

  ## Cleanup controller configuration
  cleanupController:
    enabled: true
    replicas: {{< .Values.deploykf_dependencies.kyverno.cleanupController.replicas | conv.ToInt >}}
    resources: {{< .Values.deploykf_dependencies.kyverno.cleanupController.resources | toJSON >}}
    image:
      registry: ""
      repository: {{< .Values.deploykf_dependencies.kyverno.images.kyvernoCleanupController.repository | quote >}}
      {{<- if .Values.deploykf_dependencies.kyverno.images.kyvernoCleanupController.tag >}}
      tag: {{< .Values.deploykf_dependencies.kyverno.images.kyvernoCleanupController.tag | quote >}}
      {{<- end >}}
      pullPolicy: {{< .Values.deploykf_dependencies.kyverno.images.kyvernoCleanupController.pullPolicy | quote >}}
    rbac:
      clusterRole:
        extraResources:
          {{<- range $extra_resource := $extra_resources >}}
          - apiGroups: {{< $extra_resource.apiGroups | toJSON >}}
            resources: {{< $extra_resource.resources | toJSON >}}
            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
          {{<- end >}}

  ## Reports controller configuration
  reportsController:
    enabled: true
    replicas: {{< .Values.deploykf_dependencies.kyverno.reportsController.replicas | conv.ToInt >}}
    resources: {{< .Values.deploykf_dependencies.kyverno.reportsController.resources | toJSON >}}
    image:
      registry: ""
      repository: {{< .Values.deploykf_dependencies.kyverno.images.kyvernoReportsController.repository | quote >}}
      {{<- if .Values.deploykf_dependencies.kyverno.images.kyvernoReportsController.tag >}}
      tag: {{< .Values.deploykf_dependencies.kyverno.images.kyvernoReportsController.tag | quote >}}
      {{<- end >}}
      pullPolicy: {{< .Values.deploykf_dependencies.kyverno.images.kyvernoReportsController.pullPolicy | quote >}}
    rbac:
      clusterRole:
        extraResources: []