{{- define "spire-lib.namespace.default_server_labels" }}
"pod-security.kubernetes.io/warn": restricted
"pod-security.kubernetes.io/audit": restricted
"pod-security.kubernetes.io/enforce": restricted
{{- end }}
{{- define "spire-lib.namespace.server" }}
{{- if or .Values.global.spire.namespaces.create .Values.global.spire.namespaces.server.create }}
{{-   $labels := dict }}
{{-   if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespacePSS" true .Values.global) }}
{{-     $labels = mergeOverwrite $labels (include "spire-lib.namespace.default_server_labels" . | fromYaml) }}
{{-     if (dig "openshift" false .Values.global) }}
{{-       $_ := set $labels "security.openshift.io/scc.podSecurityLabelSync" "false" }}
{{-       if (index .Values "spiffe-oidc-discovery-provider").enabled }}
{{-         $_ := set $labels "pod-security.kubernetes.io/enforce" "privileged" }}
{{-       end }}
{{-     end }}
{{-   end }}
{{-   $labels = mergeOverwrite $labels .Values.global.spire.namespaces.server.labels }}
apiVersion: v1
kind: Namespace
metadata:
  name: {{ .Values.global.spire.namespaces.server.name }}
  {{- with $labels }}
  labels:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  {{- with .Values.global.spire.namespaces.server.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
{{- end }}
{{- end }}