{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}

{{- if and .Values.pluginBarmanCloud.tls.autoGenerated.enabled (eq .Values.pluginBarmanCloud.tls.autoGenerated.engine "cert-manager") }}
{{/* We create two certs, one for the client and another for the server. Depending on whether these are provided or not */}}
{{- $secrets := list }}
{{- if not .Values.pluginBarmanCloud.tls.server.existingSecret }}
{{- $secrets = append $secrets (printf "%s-server-crt" (include "cloudnative-pg.plugin-barman-cloud.fullname" .) | trunc 63 | trimSuffix "-") }}
{{- end }}
{{- if not .Values.pluginBarmanCloud.tls.client.existingSecret }}
{{- $secrets = append $secrets (printf "%s-client-crt" (include "cloudnative-pg.plugin-barman-cloud.fullname" .) | trunc 63 | trimSuffix "-") }}
{{- end }}
{{- range $secret := $secrets }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ $secret }}
  namespace: {{ include "common.names.namespace" $ | quote }}
  {{- /* Updating app.kubernetes.io/name because to avoid "duplicate deployment" error: https://github.com/cloudnative-pg/cloudnative-pg/blob/9c2769815ff78cbfc28e2a2818f3a04add33477c/pkg/certs/operator_deployment.go#L120 */}}
  {{- $appNameLabels := dict "app.kubernetes.io/name" "plugin-barman-cloud" }}
  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list $appNameLabels $.Values.commonLabels) "context" $ ) }}
  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
    app.kubernetes.io/part-of: cloudnative-pg
    app.kubernetes.io/component: plugin-barman-cloud
  {{- if $.Values.commonAnnotations }}
  annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
  {{- end }}
spec:
  secretName: {{ $secret }}
  commonName: {{ printf "%s.%s.svc.%s" (include "cloudnative-pg.plugin-barman-cloud.fullname" $) (include "common.names.namespace" $) $.Values.clusterDomain }}
  issuerRef:
    name: {{ default (printf "%s-clusterissuer" (include "cloudnative-pg.plugin-barman-cloud.fullname" $)) $.Values.pluginBarmanCloud.tls.autoGenerated.certManager.existingIssuer }}
    kind: {{ default "Issuer" $.Values.pluginBarmanCloud.tls.autoGenerated.certManager.existingIssuerKind }}
  subject:
    organizations:
      - "Barman Cloud Plugin"
  dnsNames:
    - '{{ include "cloudnative-pg.plugin-barman-cloud.fullname" $ }}'
    - '*.{{ include "common.names.namespace" $ }}'
    - '*.{{ include "common.names.namespace" $ }}.svc'
    - '*.{{ include "common.names.namespace" $ }}.svc.{{ $.Values.clusterDomain }}'
    - '*.{{ include "cloudnative-pg.plugin-barman-cloud.fullname" $ }}'
    - '*.{{ include "cloudnative-pg.plugin-barman-cloud.fullname" $ }}.{{ include "common.names.namespace" $ }}'
    - '*.{{ include "cloudnative-pg.plugin-barman-cloud.fullname" $ }}.{{ include "common.names.namespace" $ }}.svc'
    - '*.{{ include "cloudnative-pg.plugin-barman-cloud.fullname" $ }}.{{ include "common.names.namespace" $ }}.svc.{{ $.Values.clusterDomain }}'
  privateKey:
    algorithm: {{ $.Values.pluginBarmanCloud.tls.autoGenerated.certManager.keyAlgorithm }}
    size: {{ int $.Values.pluginBarmanCloud.tls.autoGenerated.certManager.keySize }}
  duration: {{ $.Values.pluginBarmanCloud.tls.autoGenerated.certManager.duration }}
  renewBefore: {{ $.Values.pluginBarmanCloud.tls.autoGenerated.certManager.renewBefore }}
{{- end }}
{{- end }}
