apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
{{- if .Values.certificates.certManager.enabled }}
  annotations:
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "externalip-webhook.fullname" . }}-server-cert
{{- end }}
  creationTimestamp: null
  name: {{ template "externalip-webhook.fullname" . }}-validating-webhook-configuration
webhooks:
- clientConfig:
{{- if not (.Values.certificates.certManager.enabled) }}
    caBundle: {{ .Values.certificates.caBundle }}
{{- end }}
    service:
      name: {{ template "externalip-webhook.fullname" . }}
      namespace: {{ .Release.Namespace }}
      path: /validate-service
  failurePolicy: Ignore
  name: {{ template "externalip-webhook.fullname" . }}.{{ .Release.Namespace }}.svc
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - services