apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
  name: {{ .Release.Name }}-ca
  namespace: {{ .Release.Namespace }}
spec:
  isCA: true
  duration: {{ .Values.cert.duration }}
  renewBefore: {{ .Values.cert.renewBefore }}
  commonName: "kubernetes"
  secretName: {{ .Release.Name }}-ca
  issuerRef:
    name: {{ .Values.issuer }}
    kind: ClusterIssuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1alpha3
kind: Issuer
metadata:
  name: {{ .Release.Name }}-issuer
  namespace: {{ .Release.Namespace }}
spec:
  ca:
    secretName: {{ .Release.Name }}-ca

---
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
  name: {{ .Release.Name }}
  namespace: {{ .Release.Namespace }}
spec:
  secretName: {{ .Release.Name }}
  duration: {{ .Values.cert.duration }}
  renewBefore: {{ .Values.cert.renewBefore }}
  commonName: "kube-apiserver"
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages: # both for server and client usages
    - server auth
    - client auth
  dnsNames:
    - "localhost"
    - "kubernetes"
    - "kubernetes.default"
    - "kubernetes.default.svc"
    - "kubernetes.default.svc.cluster"
    - "kubernetes.default.svc.cluster.local"
    - "{{ .Release.Name }}"
    - "{{ .Release.Name }}.{{ .Release.Namespace }}"
    - "{{ .Release.Name }}.{{ .Release.Namespace }}.svc"
    - "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"
    - "*.{{ .Release.Name }}"
    - "*.{{ .Release.Name }}.{{ .Release.Namespace }}"
    - "*.{{ .Release.Name }}.{{ .Release.Namespace }}.svc"
    - "*.{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"
  {{ if .Values.cert.extralDnsNames }}
{{ toYaml .Values.cert.extralDnsNames | indent 4 }}
  {{ end }}
  ipAddresses:
    - 127.0.0.1
    - ::1
  {{ if .Values.cert.extralIpAddresses }}
{{ toYaml .Values.cert.extralIpAddresses | indent 4 }}
  {{ end }}
  issuerRef:
    name: {{ .Release.Name }}-issuer
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
  name: {{ .Release.Name }}-service-account-key # we'll only use the generated private key, not the cert
  namespace: {{ .Release.Namespace }}
spec:
  secretName: {{ .Release.Name }}-service-account-key
  duration: {{ .Values.cert.duration }}
  renewBefore: {{ .Values.cert.renewBefore }}
  commonName: "kubernetes"
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages:
    - client auth
  issuerRef:
    name: {{ .Release.Name }}-issuer
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
  name: {{ .Release.Name }}-kube-controller-manager
  namespace: {{ .Release.Namespace }}
spec:
  secretName: {{ .Release.Name }}-kube-controller-manager
  duration: {{ .Values.cert.duration }}
  renewBefore: {{ .Values.cert.renewBefore }}
  commonName: "system:kube-controller-manager"
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages:
    - client auth
  issuerRef:
    name: {{ .Release.Name }}-issuer
    kind: Issuer
    group: cert-manager.io

---
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
  name: {{ .Release.Name }}-admin
  namespace: {{ .Release.Namespace }}
spec:
  secretName: {{ .Release.Name }}-admin
  duration: {{ .Values.cert.duration }}
  renewBefore: {{ .Values.cert.renewBefore }}
  subject:
    organizations:
      - "system:masters"
  commonName: "kubernetes-admin"
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages:
    - client auth
  issuerRef:
    name: {{ .Release.Name }}-issuer
    kind: Issuer
    group: cert-manager.io

---
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
  name: {{ .Release.Name }}-aggregator-ca
  namespace: {{ .Release.Namespace }}
spec:
  isCA: true
  duration: {{ .Values.cert.duration }}
  renewBefore: {{ .Values.cert.renewBefore }}
  commonName: "kubernetes"
  secretName: {{ .Release.Name }}-aggregator-ca
  issuerRef:
    name: {{ .Values.issuer }}
    kind: ClusterIssuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1alpha3
kind: Issuer
metadata:
  name: {{ .Release.Name }}-aggregator-issuer
  namespace: {{ .Release.Namespace }}
spec:
  ca:
    secretName: {{ .Release.Name }}-aggregator-ca
---
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
  name: {{ .Release.Name }}-aggregator
  namespace: {{ .Release.Namespace }}
spec:
  secretName: {{ .Release.Name }}-aggregator
  duration: {{ .Values.cert.duration }}
  renewBefore: {{ .Values.cert.renewBefore }}
  commonName: "kubernetes"
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages: # client usage only
    - client auth
  issuerRef:
    name: {{ .Release.Name }}-aggregator-issuer
    kind: Issuer
    group: cert-manager.io