{{- if .Values.custom.admission_enable }}
{{ $admission_affinity := or .Values.custom.admission_affinity .Values.custom.default_affinity }}
{{ $admission_tolerations := or .Values.custom.admission_tolerations .Values.custom.default_tolerations }}
{{ $admission_sc := or .Values.custom.admission_sc .Values.custom.default_sc }}
{{ $admission_ns := or .Values.custom.admission_ns .Values.custom.default_ns }}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Release.Name }}-admission-init
  namespace: {{ .Release.Namespace }}
  {{- if .Values.custom.common_labels }}
  labels:
    {{- toYaml .Values.custom.common_labels | nindent 4 }}
  {{- end }}
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
    "helm.sh/hook-weight": "0"

---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}-admission-init
  namespace: {{ .Release.Namespace }}
  {{- if .Values.custom.common_labels }}
  labels:
    {{- toYaml .Values.custom.common_labels | nindent 4 }}
  {{- end }}
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
    "helm.sh/hook-weight": "0"
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["create", "patch", "get"]

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}-admission-init-role
  namespace: {{ .Release.Namespace }}
  {{- if .Values.custom.common_labels }}
  labels:
    {{- toYaml .Values.custom.common_labels | nindent 4 }}
  {{- end }}
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
    "helm.sh/hook-weight": "0"
subjects:
  - kind: ServiceAccount
    name: {{ .Release.Name }}-admission-init
    namespace: {{ .Release.Namespace }}
roleRef:
  kind: Role
  name: {{ .Release.Name }}-admission-init
  apiGroup: rbac.authorization.k8s.io

---
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ .Release.Name }}-admission-init
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
    "helm.sh/hook-weight": "5" # set a higher weight to reserve buffers.
  labels:
    app: volcano-admission-init
    {{- if or (.Values.custom.admission_labels) (.Values.custom.common_labels) }}
    {{- mustMerge (.Values.custom.admission_labels | default (dict)) (.Values.custom.common_labels | default (dict)) | toYaml | nindent 4 }}
    {{- end }}
spec:
  backoffLimit: 3
  template:
    spec:
      {{- if $admission_tolerations }}
      tolerations: {{- toYaml $admission_tolerations | nindent 8 }}
      {{- end }}
      {{- if $admission_ns }}
      nodeSelector: {{- toYaml $admission_ns | nindent 8 }}
      {{- end }}
      {{- if $admission_affinity }}
      affinity:
        {{- toYaml $admission_affinity | nindent 8 }}
      {{- end }}
      {{- if $admission_sc }}
      securityContext:
        {{- toYaml $admission_sc | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ .Release.Name }}-admission-init
      priorityClassName: system-cluster-critical
      {{- if .Values.basic.image_pull_secret }}
      imagePullSecrets:
        - name: {{ .Values.basic.image_pull_secret }}
      {{- end }}
      restartPolicy: Never
      containers:
        - name: main
          {{- if .Values.custom.admission_resources }}
          resources:
          {{- toYaml .Values.custom.admission_resources | nindent 12 }}
          {{- end }}
          image: {{ .Values.basic.image_registry }}/{{.Values.basic.admission_image_name}}:{{.Values.basic.image_tag_version}}
          imagePullPolicy: {{ .Values.basic.image_pull_policy }}
          command: ["./gen-admission-secret.sh", "--service", "{{ .Release.Name }}-admission-service", "--namespace",
                    "{{ .Release.Namespace }}", "--secret", "{{.Values.basic.admission_secret_name}}"]
          {{- if .Values.custom.admission_default_csc }}
          securityContext:
            {{- toYaml .Values.custom.admission_default_csc | nindent 12 }}
          {{- end }}
{{- end }}
