{{- define "pomerium.signingKeySecretObject" -}}
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  annotations:
    helm.sh/hook-delete-policy: before-hook-creation
{{- if .Values.config.forceGenerateSigningKey }}
    helm.sh/hook: pre-upgrade
{{- else if .Values.config.generateSigningKey }}
    helm.sh/hook: pre-install
{{- end }}
  name: {{ template "pomerium.signingKeySecret.name" . }}
type: Opaque
data:
{{- end -}}

{{- if and .Values.config.generateSigningKey (or .Release.IsInstall .Values.config.forceGenerateSigningKey) }}
{{ template "pomerium.signingKeySecretObject" . }}
  signing-key: {{ genPrivateKey "ecdsa" | b64enc | b64enc }}
{{-   else if not .Values.config.generateSigningKey }}
{{-     if and (not .Values.config.existingSigningKeySecret) .Values.config.signingKey }}
{{ template "pomerium.signingKeySecretObject" . }}
  signing-key: {{ .Values.config.signingKey | b64enc }}
{{-     end }}
{{- end }}
