{{ .Chart.Name }} {{ .Chart.AppVersion }} has been installed.

Controller namespace : {{ include "k8s-injection-controller.namespace" . }}
Watched namespace    : {{ include "k8s-injection-controller.watchNamespace" . }} (ConfigMaps written by Beyla)
Deployment           : {{ include "k8s-injection-controller.fullname" . }}

Check the controller is running:

  kubectl -n {{ include "k8s-injection-controller.namespace" . }} rollout status deployment/{{ include "k8s-injection-controller.fullname" . }}
  kubectl -n {{ include "k8s-injection-controller.namespace" . }} logs deployment/{{ include "k8s-injection-controller.fullname" . }} -c manager -f

{{- $certMode := include "k8s-injection-controller.certMode" . -}}
{{- $installCM := eq (include "k8s-injection-controller.installCertManager" .) "true" -}}
Webhook serving certificate ({{ $certMode }} mode):
{{- if eq $certMode "self-signed" }}

The controller self-manages it — it generates and rotates a self-signed CA +
serving cert in-process and injects the CA into the webhook configurations. No
cert-manager required.
{{- else if $installCM }}

A pre-install hook installs cert-manager on the fly (it no-ops if cert-manager is
already present). cert-manager then issues the serving cert and injects the CA;
the Issuer/Certificate are applied as POST-INSTALL hooks, so the controller pod
stays in ContainerCreating for a few seconds until the Secret is issued. NOTE:
`--wait` / `--atomic` do not work on the first install in this mode (see the chart
README). Confirm cert-manager is Ready:

  kubectl -n cert-manager rollout status deployment/cert-manager-webhook
{{- else }}

cert-manager is a PREREQUISITE: the chart renders Issuer/Certificate and relies on
cert-manager to issue the serving cert and inject the CA. Make sure cert-manager is
installed and Ready, otherwise the webhook Secret is never created and the
controller pod stays un-ready:

  kubectl -n cert-manager rollout status deployment/cert-manager-webhook
{{- end }}

{{- if not .Values.sdkConfig.enabled }}

NOTE: sdkConfig.enabled=false — the controller will select matching workloads
but perform no instrumentation until an SDK config is provided.
{{- end }}
