{{- if .Values.topologyInjector.enabled }}

{{ $watchedNamespaces := list }}
{{ $gatewayNamespaceMode := false}}
{{- if .Values.config.envoyGateway.provider.kubernetes }}
{{- $kube := .Values.config.envoyGateway.provider.kubernetes }}
{{- $gatewayNamespaceMode = and ($kube.deploy) (eq $kube.deploy.type "GatewayNamespace") }}
{{- if $kube.watch }}
{{- if $kube.watch.namespaces }}
{{- if gt (len $kube.watch.namespaces) 0 }}
{{- $watchedNamespaces = $kube.watch.namespaces }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: 'envoy-gateway-topology-injector.{{ .Release.Namespace }}'
  annotations:
    "helm.sh/hook": pre-install, pre-upgrade
    "helm.sh/hook-weight": "-1"
  {{- if .Values.topologyInjector.annotations }}
    {{- toYaml .Values.topologyInjector.annotations | nindent 4 -}}
  {{- end }}
  labels:
    app.kubernetes.io/component: topology-injector
  {{- include "eg.labels" . | nindent 4 }}
webhooks:
  - name: topology.webhook.gateway.envoyproxy.io
    admissionReviewVersions: ["v1"]
    sideEffects: None
    clientConfig:
      service:
        name: envoy-gateway
        namespace: '{{ .Release.Namespace }}'
        path: "/inject-pod-topology"
        port: 9443
    failurePolicy: Ignore
    rules:
      - operations: ["CREATE"]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods/binding"]
    {{- if not $gatewayNamespaceMode }}
    namespaceSelector:
      matchExpressions:
        - key: kubernetes.io/metadata.name
          operator: In
          values:
            - {{ .Release.Namespace }}
    {{- else if gt (len $watchedNamespaces) 0 }}
    namespaceSelector:
      matchExpressions:
        - key: kubernetes.io/metadata.name
          operator: In
          values:
          {{- range $watchedNamespaces }}
            - {{ . | quote }}
          {{- end }}
    {{- end }}
{{- end }}