apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
  name: {{ .Release.Name }}-ca
  namespace: {{ .Release.Namespace }}
spec:
  isCA: true
  duration: {{ .Values.cert.duration }}
  renewBefore: {{ .Values.cert.renewBefore }}
  commonName: {{ .Release.Name }}
  secretName: {{ .Release.Name }}-ca
  issuerRef:
    name: {{ .Values.issuer }}
    kind: ClusterIssuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1alpha3
kind: Issuer
metadata:
  name: {{ .Release.Name }}-issuer
  namespace: {{ .Release.Namespace }}
spec:
  ca:
    secretName: {{ .Release.Name }}-ca
---
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
  name: {{ .Release.Name }}-server-client
  namespace: {{ .Release.Namespace }}
spec:
  secretName: {{ .Release.Name }}-server-client
  duration: {{ .Values.cert.duration }}
  renewBefore: {{ .Values.cert.renewBefore }}
  subject:
  commonName: {{ .Release.Name }}
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages: # both for server and client usages
    - server auth
    - client auth
  dnsNames:
    - "{{ .Release.Name }}"
    - "{{ .Release.Name }}.{{ .Release.Namespace }}"
    - "{{ .Release.Name }}.{{ .Release.Namespace }}.svc"
    - "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"
    - "*.{{ .Release.Name }}"
    - "*.{{ .Release.Name }}.{{ .Release.Namespace }}"
    - "*.{{ .Release.Name }}.{{ .Release.Namespace }}.svc"
    - "*.{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"
    - {{ printf "%s-headless" .Release.Name | quote }}
    - {{ printf "%s-headless.%s" .Release.Name .Release.Namespace | quote }}
    - {{ printf "%s-headless.%s.svc" .Release.Name .Release.Namespace | quote }}
    - {{ printf "%s-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain | quote }}
    - {{ printf "*.%s-headless" .Release.Name | quote }}
    - {{ printf "*.%s-headless.%s" .Release.Name .Release.Namespace | quote }}
    - {{ printf "*.%s-headless.%s.svc" .Release.Name .Release.Namespace | quote }}
    - {{ printf "*.%s-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain | quote }}
  ipAddresses:
    - 127.0.0.1
    - ::1
  issuerRef:
    name: {{ .Release.Name }}-issuer
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
  name: {{ .Release.Name }}-client
  namespace: {{ .Release.Namespace }}
spec:
  secretName: {{ .Release.Name }}-client
  duration: {{ .Values.cert.duration }}
  renewBefore: {{ .Values.cert.renewBefore }}
  commonName: {{ .Release.Name }}
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages: # client usage only
    - client auth
  issuerRef:
    name: {{ .Release.Name }}-issuer
    kind: Issuer
    group: cert-manager.io