apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: metallb-webhook-configuration
  labels:
    {{- include "metallb.labels" . | nindent 4 }}
webhooks:
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /validate-metallb-io-v1beta1-addresspool
  failurePolicy: {{ .Values.crds.validationFailurePolicy }}
  name: addresspoolvalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - addresspools
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /validate-metallb-io-v1beta2-bgppeer
  failurePolicy: {{ .Values.crds.validationFailurePolicy }}
  name: bgppeervalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta2
    operations:
    - CREATE
    - UPDATE
    resources:
    - bgppeers
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /validate-metallb-io-v1beta1-ipaddresspool
  failurePolicy: {{ .Values.crds.validationFailurePolicy }}
  name: ipaddresspoolvalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - ipaddresspools
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /validate-metallb-io-v1beta1-bgpadvertisement
  failurePolicy: {{ .Values.crds.validationFailurePolicy }}
  name: bgpadvertisementvalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - bgpadvertisements
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /validate-metallb-io-v1beta1-community
  failurePolicy: {{ .Values.crds.validationFailurePolicy }}
  name: communityvalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - communities
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /validate-metallb-io-v1beta1-bfdprofile
  failurePolicy: {{ .Values.crds.validationFailurePolicy }}
  name: bfdprofilevalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - DELETE
    resources:
    - bfdprofiles
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: {{ .Release.Namespace }}
      path: /validate-metallb-io-v1beta1-l2advertisement
  failurePolicy: {{ .Values.crds.validationFailurePolicy }}
  name: l2advertisementvalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - l2advertisements
  sideEffects: None
---
apiVersion: v1
kind: Service
metadata:
  name: metallb-webhook-service
  namespace: {{ .Release.Namespace | quote }}
  labels:
    {{- include "metallb.labels" . | nindent 4 }}
spec:
  ports:
  - port: 443
    targetPort: 9443
  selector:
    {{- include "metallb.selectorLabels" . | nindent 4 }}
    app.kubernetes.io/component: controller
---
apiVersion: v1
kind: Secret
metadata:
  name: webhook-server-cert
  namespace: {{ .Release.Namespace | quote }}
  labels:
    {{- include "metallb.labels" . | nindent 4 }}