repositories:
  - name: sysdig
    url: https://charts.sysdig.com

releases:
  - chart: sysdig/sysdig-deploy
    version: 1.55.3
    name: sysdig
    namespace: sysdig
    needs:
      - sysdig/sysdig-admissioncontroller-webhook-cert
    values:
      - admissionController:
          enabled: true
        # webhook:
        #   ssl:
        #     ca:
        #       existingCaSecret: sysdig-admissioncontroller-webhook-tls
    # NOTE: START HACKS
    jsonPatches:
      - target:
          group: admissionregistration.k8s.io
          kind: ValidatingWebhookConfiguration
          name: sysdig-admissioncontroller-webhook
          version: v1
        patch:
          - op: add
            path: /metadata/annotations
            value:
              cert-manager.io/inject-ca-from: sysdig/sysdig-admissioncontroller-webhook
          - op: remove
            path: /webhooks/0/clientConfig/caBundle
    strategicMergePatches:
      - $patch: delete
        apiVersion: v1
        kind: Secret
        metadata:
          name: sysdig-admissioncontroller-webhook-tls
          namespace: sysdig
    # NOTE: END HACKS
  - chart: sysdig-admissioncontroller-webhook-cert
    name: sysdig-admissioncontroller-webhook-cert
    namespace: sysdig

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: sysdig-admissioncontroller-webhook
  namespace: sysdig
spec:
  commonName: sysdig-admissioncontroller-webhook
  dnsNames:
  - sysdig-admissioncontroller-webhook.sysdig.svc
  issuerRef:
    group: cert-manager.io
    kind: ClusterIssuer
    name: selfsigning-issuer
  secretName: sysdig-admissioncontroller-webhook-tls

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
  name: selfsigning-issuer
spec:
  selfSigned: {}

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: sysdig/sysdig-admissioncontroller-webhook
  name: sysdig-admissioncontroller-webhook
  namespace: sysdig
webhooks:
- admissionReviewVersions:
  - v1
  - v1beta1
  clientConfig:
    service:
      name: sysdig-admissioncontroller-webhook
      namespace: sysdig
      path: /k8s-audit
      port: 443
  failurePolicy: Ignore
  matchPolicy: Equivalent
  name: audit.secure.sysdig.com
  rules:
  - apiGroups:
    - ""
    - apps
    - autoscaling
    - batch
    - networking.k8s.io
    - rbac.authorization.k8s.io
    - extensions
    apiVersions:
    - '*'
    operations:
    - '*'
    resources:
    - '*/*'
    scope: '*'
  sideEffects: None
  timeoutSeconds: 5