{{define "handlerPrefix"}}{{with $prefix := .HandlerPrefix}}{{$prefix | printf "%s-"}}{{end -}}{{end}}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{template "handlerPrefix" .}}nmstate-webhook
  namespace: {{ .HandlerNamespace }}
  labels:
    app: kubernetes-nmstate
    component: kubernetes-nmstate-webhook
spec:
  replicas: 2
  strategy:
    type: Recreate
  selector:
    matchLabels:
      name: {{template "handlerPrefix" .}}nmstate-webhook
  template:
    metadata:
      labels:
        app: kubernetes-nmstate
        component: kubernetes-nmstate-webhook
        name: {{template "handlerPrefix" .}}nmstate-webhook
      annotations:
        description: kubernetes-nmstate-webhook resets NNCP status
    spec:
      serviceAccountName: {{template "handlerPrefix" .}}nmstate-handler
      nodeSelector: {{ toYaml .WebhookNodeSelector | nindent 8 }}
      tolerations: {{ toYaml .WebhookTolerations | nindent 8 }}
      affinity: {{ toYaml .WebhookAffinity | nindent 8 }}
      containers:
        - name: nmstate-webhook
          args:
          - --v=production
          # Replace this with the built image name
          image: {{ .HandlerImage }}
          imagePullPolicy: {{ .HandlerPullPolicy }}
          command:
          - manager
          env:
            - name: WATCH_NAMESPACE
              value: ""
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: RUN_WEBHOOK_SERVER
              value: ""
            - name: OPERATOR_NAME
              value: "{{template "handlerPrefix" .}}nmstate"
            - name: ENABLE_PROFILER
              value: "False"
            - name: PROFILER_PORT
              value: "6060"
            - name: CA_ROTATE_INTERVAL
              value: {{ .CARotateInterval | default "8760h0m0s" }}
            - name: CA_OVERLAP_INTERVAL
              value: {{ .CAOverlapInterval | default "8760h0m0s" }}
            - name: CERT_ROTATE_INTERVAL
              value: {{ .CertRotateInterval | default "4380h0m0s" }}
          ports:
          - containerPort: 8443
            name: webhook-server
            protocol: TCP
          readinessProbe:
            httpGet:
              path: /readyz
              port: webhook-server
              scheme: HTTPS
              httpHeaders:
              - name: Content-Type
                value: application/json
            initialDelaySeconds: 10
            periodSeconds: 10
          volumeMounts:
          - name: tls-key-pair
            readOnly: true
            mountPath: /etc/webhook/certs
      volumes:
        - name: tls-key-pair
          secret:
            secretName: {{template "handlerPrefix" .}}nmstate-webhook
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: {{template "handlerPrefix" .}}nmstate-handler
  namespace: {{ .HandlerNamespace }}
  labels:
    app: kubernetes-nmstate
    component: kubernetes-nmstate-handler
spec:
  selector:
    matchLabels:
      name: {{template "handlerPrefix" .}}nmstate-handler
  template:
    metadata:
      labels:
        app: kubernetes-nmstate
        component: kubernetes-nmstate-handler
        name: {{template "handlerPrefix" .}}nmstate-handler
      annotations:
        description: kubernetes-nmstate-handler configures and presents node networking, reconciling declerative NNCP and reports with NNS and NNCE
    spec:
      # Needed to force vlan filtering config with iproute commands until
      # future nmstate/NM is in place.
      # https://github.com/nmstate/nmstate/pull/440
      hostNetwork: true
      # Use Default to get node's DNS configuration [1]
      # [1] https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
      dnsPolicy: Default
      serviceAccountName: {{template "handlerPrefix" .}}nmstate-handler
      nodeSelector: {{ toYaml .HandlerNodeSelector | nindent 8 }}
      tolerations: {{ toYaml .HandlerTolerations | nindent 8 }}
      affinity: {{ toYaml .HandlerAffinity | nindent 8 }}
      containers:
        - name: nmstate-handler
          args:
          - --v=production
          # Replace this with the built image name
          image: {{ .HandlerImage }}
          imagePullPolicy: {{ .HandlerPullPolicy }}
          command:
            - manager
          env:
            - name: WATCH_NAMESPACE
              value: ""
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: "{{template "handlerPrefix" .}}nmstate"
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: INTERFACES_FILTER
              valueFrom:
                configMapKeyRef:
                  name: {{template "handlerPrefix" .}}nmstate-config
                  key: interfaces_filter
            - name: ENABLE_PROFILER
              value: "False"
            - name: PROFILER_PORT
              value: "6060"
            - name: NMSTATE_INSTANCE_NODE_LOCK_FILE
              value: "/var/k8s_nmstate/handler_lock"
          volumeMounts:
            - name: dbus-socket
              mountPath: /run/dbus/system_bus_socket
            - name: nmstate-lock
              mountPath: /var/k8s_nmstate
          securityContext:
            privileged: true
      volumes:
        - name: dbus-socket
          hostPath:
            path: /run/dbus/system_bus_socket
            type: Socket
        - name: nmstate-lock
          hostPath:
            path: /var/k8s_nmstate
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{template "handlerPrefix" .}}nmstate-config
  namespace: {{ .HandlerNamespace }}
data:
  interfaces_filter: "veth*"
---
apiVersion: v1
kind: Service
metadata:
  name: {{template "handlerPrefix" .}}nmstate-webhook
  namespace: {{ .HandlerNamespace }}
  labels:
    app: kubernetes-nmstate
spec:
  publishNotReadyAddresses: true
  ports:
    - port: 443
      targetPort: 8443
  selector:
    name: {{template "handlerPrefix" .}}nmstate-webhook
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: {{template "handlerPrefix" .}}nmstate
  labels:
    app: kubernetes-nmstate
webhooks:
  - name: nodenetworkconfigurationpolicies-mutate.nmstate.io
    clientConfig:
      service:
        name: {{template "handlerPrefix" .}}nmstate-webhook
        namespace: {{ .HandlerNamespace }}
        path: "/nodenetworkconfigurationpolicies-mutate"
    rules:
      - operations: ["CREATE", "UPDATE"]
        apiGroups: ["*"]
        apiVersions: ["v1alpha1","v1beta1"]
        resources: ["nodenetworkconfigurationpolicies"]
  - name: nodenetworkconfigurationpolicies-status-mutate.nmstate.io
    clientConfig:
      service:
        name: {{template "handlerPrefix" .}}nmstate-webhook
        namespace: {{ .HandlerNamespace }}
        path: "/nodenetworkconfigurationpolicies-status-mutate"
    rules:
      - operations: ["CREATE", "UPDATE"]
        apiGroups: ["*"]
        apiVersions: ["v1alpha1","v1beta1"]
        resources: ["nodenetworkconfigurationpolicies/status"]
  - name: nodenetworkconfigurationpolicies-timestamp-mutate.nmstate.io
    clientConfig:
      service:
        name: {{template "handlerPrefix" .}}nmstate-webhook
        namespace: {{ .HandlerNamespace }}
        path: "/nodenetworkconfigurationpolicies-timestamp-mutate"
    rules:
      - operations: ["CREATE", "UPDATE"]
        apiGroups: ["*"]
        apiVersions: ["v1alpha1","v1beta1"]
        resources: ["nodenetworkconfigurationpolicies", "nodenetworkconfigurationpolicies/status"]
---
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  namespace: {{ .HandlerNamespace }}
  name: {{template "handlerPrefix" .}}nmstate-webhook
spec:
  minAvailable: 1
  selector:
    matchLabels:
      name: {{template "handlerPrefix" .}}nmstate-webhook
---
apiVersion: v1
kind: Secret
metadata:
  name: {{template "handlerPrefix" .}}nmstate-webhook
  namespace: {{ .HandlerNamespace }}
type: kubernetes.io/tls
data:
  tls.crt: YmFkIGNlcnRpZmljYXRlCg==
  tls.key: YmFkIGtleQo=
