{{- if and .Values.ingress.enabled (and .Values.ingressController.enabled .Values.ingressController.config.operatorMode ) }}
{{- if not .Values.ingress.secretName }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ .Values.ingress.secret.name }}
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
type: kubernetes.io/tls
data:
  tls.crt: {{ .Values.ingress.secret.cert | quote }}
  tls.key: {{ .Values.ingress.secret.key | quote }}
---
{{- end }}
{{- end }}

{{- define "pomerium.authenticate.tlsSecretObject" -}}
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  annotations:
    helm.sh/hook-delete-policy: before-hook-creation
{{- if .Values.config.forceGenerateTLS }}
    helm.sh/hook: pre-upgrade
{{- else if .Values.config.generateTLS }}
    helm.sh/hook: pre-install
{{- end }}
{{- if .Values.config.generateTLSAnnotations }}
    {{- range $key, $value := .Values.config.generateTLSAnnotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
{{- end }}
  name: {{ template "pomerium.authenticate.tlsSecret.name" . }}
type: kubernetes.io/tls
data:
{{- end -}}

{{- define "pomerium.authorize.tlsSecretObject" -}}
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  annotations:
    helm.sh/hook-delete-policy: before-hook-creation
{{- if .Values.config.forceGenerateTLS }}
    helm.sh/hook: pre-upgrade
{{- else if .Values.config.generateTLS }}
    helm.sh/hook: pre-install
{{- end }}
{{- if .Values.config.generateTLSAnnotations }}
    {{- range $key, $value := .Values.config.generateTLSAnnotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
{{- end }}
  name: {{ template "pomerium.authorize.tlsSecret.name" . }}
type: kubernetes.io/tls
data:
{{- end -}}

{{- define "pomerium.databroker.tlsSecretObject" -}}
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  annotations:
    helm.sh/hook-delete-policy: before-hook-creation
{{- if .Values.config.forceGenerateTLS }}
    helm.sh/hook: pre-upgrade
{{- else if .Values.config.generateTLS }}
    helm.sh/hook: pre-install
{{- end }}
{{- if .Values.config.generateTLSAnnotations }}
    {{- range $key, $value := .Values.config.generateTLSAnnotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
{{- end }}
  name: {{ template "pomerium.databroker.tlsSecret.name" . }}
type: kubernetes.io/tls
data:
{{- end -}}

{{- define "pomerium.proxy.tlsSecretObject" -}}
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  annotations:
    helm.sh/hook-delete-policy: before-hook-creation
{{- if .Values.config.forceGenerateTLS }}
    helm.sh/hook: pre-upgrade
{{- else if .Values.config.generateTLS }}
    helm.sh/hook: pre-install
{{- end }}
{{- if .Values.config.generateTLSAnnotations }}
    {{- range $key, $value := .Values.config.generateTLSAnnotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
{{- end }}
  name: {{ template "pomerium.proxy.tlsSecret.name" . }}
type: kubernetes.io/tls
data:
{{- end -}}

{{- define "pomerium.ca.tlsSecretObject" -}}
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  annotations:
    helm.sh/hook-delete-policy: before-hook-creation
{{- if .Values.config.forceGenerateTLS }}
    helm.sh/hook: pre-upgrade
{{- else if .Values.config.generateTLS }}
    helm.sh/hook: pre-install
{{- end }}
{{- if .Values.config.generateTLSAnnotations }}
    {{- range $key, $value := .Values.config.generateTLSAnnotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
{{- end }}
  name: {{ template "pomerium.caSecret.name" . }}
type: Opaque
data:
{{- end -}}


{{- if and .Values.config.generateTLS (or .Release.IsInstall .Values.config.forceGenerateTLS) }}
{{- $ca := genCA "default-ca" 3650 }}
{{- $authenticateSN:= list (printf "authenticate.%s" .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authenticate.fullname" .) .Release.Namespace )}}
{{- $authorizeSN:= list (printf "authorize.%s" .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authorize.fullname" .) .Release.Namespace )}}
{{- $databrokerSN:= list (printf "databroker.%s" .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.databroker.fullname" .) .Release.Namespace ) }}
{{- $proxySN:= list (printf "authenticate.%s" .Values.config.rootDomain) }}

{{- $cn := default "example.com" .Values.config.rootDomain }}
{{ template "pomerium.ca.tlsSecretObject" . }}
  ca.crt: {{ $ca.Cert | b64enc }}
  ca.key: {{ $ca.Key | b64enc }}
---
{{- $kp := genSignedCert $cn ( default nil .Values.authenticate.tls.defaultIPList ) ( default $authenticateSN .Values.authenticate.tls.defaultSANList ) 3650 $ca }}
{{ template "pomerium.authenticate.tlsSecretObject" . }}
  tls.crt: {{ $kp.Cert | b64enc }}
  tls.key: {{ $kp.Key | b64enc }}
---
{{- $kp := genSignedCert $cn ( default nil .Values.authorize.tls.defaultIPList ) ( default $authorizeSN .Values.authorize.tls.defaultSANList ) 3650 $ca }}
{{ template "pomerium.authorize.tlsSecretObject" . }}
  tls.crt: {{ $kp.Cert | b64enc }}
  tls.key: {{ $kp.Key | b64enc }}
---
{{- $kp := genSignedCert $cn ( default nil .Values.databroker.tls.defaultIPList ) ( default $databrokerSN .Values.databroker.tls.defaultSANList ) 3650 $ca }}
{{ template "pomerium.databroker.tlsSecretObject" . }}
  tls.crt: {{ $kp.Cert | b64enc }}
  tls.key: {{ $kp.Key | b64enc }}
{{-   else if not .Values.config.generateTLS }}
{{-     if and (not .Values.config.existingCASecret) .Values.config.ca.cert .Values.config.ca.key }}
{{ template "pomerium.ca.tlsSecretObject" . }}
  ca.crt: {{ .Values.config.ca.cert | b64enc }}
  ca.key: {{ .Values.config.ca.key | b64enc }}
{{-     end }}
{{-     if and (not .Values.authenticate.existingTLSSecret) .Values.authenticate.tls.cert .Values.authenticate.tls.key }}
---
{{ template "pomerium.authenticate.tlsSecretObject" . }}
  tls.crt: {{ .Values.authenticate.tls.cert | b64enc }}
  tls.key: {{ .Values.authenticate.tls.key | b64enc }}
{{-     end }}
{{-     if and (not .Values.authorize.existingTLSSecret) .Values.authorize.tls.cert .Values.authorize.tls.key }}
---
{{ template "pomerium.authorize.tlsSecretObject" . }}
  tls.crt: {{ .Values.authorize.tls.cert | b64enc }}
  tls.key: {{ .Values.authorize.tls.key | b64enc }}
{{-     end }}
{{-     if and (not .Values.databroker.existingTLSSecret) .Values.databroker.tls.cert .Values.databroker.tls.key }}
---
{{ template "pomerium.databroker.tlsSecretObject" . }}
  tls.crt: {{ .Values.databroker.tls.cert | b64enc }}
  tls.key: {{ .Values.databroker.tls.key | b64enc }}
{{-     end }}
{{-     if and (not .Values.proxy.existingTLSSecret) .Values.proxy.tls.cert .Values.proxy.tls.key }}
---
{{ template "pomerium.proxy.tlsSecretObject" . }}
  tls.crt: {{ .Values.proxy.tls.cert | b64enc }}
  tls.key: {{ .Values.proxy.tls.key | b64enc }}
{{-     end }}
{{- end }}