---
imports: (( &temporary ))
landscape: (( &temporary ))
utilities: (( &temporary ))

settings:
  groupName: cert-bridge.gardener.cloud
  solverName: certificate-dns-bridge
  namespace: cert-manager # will be created - don't choose an existing one!
  serviceAccountName: cert-manager
  self-signed: (( .caSpec.url == "self-signed" ))
  issuerName: (( .settings.self-signed ? "ca-issuer" :"acme-issuer" ))
  issuerPrivateKey: (( .settings.self-signed -or (! valid( .landscape.cert-manager.privateKey ) ) ? ~ :.landscape.cert-manager.privateKey ))
  caSecret: "self-signed-ca"
  ca:
    given: (( &temporary ( valid( .caSpec.ca.crt ) -and ( ( ! .settings.self-signed ) -or valid( .caSpec.ca.key ) ) ) )) # a given CA needs crt and key for self-signed mode
    crt: (( given ? .caSpec.ca.crt :( .state.ca.value.cert || ~~ ) ))
    key: (( given ? ( .caSpec.ca.key || ~~ ) :( .state.ca.value.key || ~~ ) ))

caSpec:
  <<: (( &temporary ))
  instantiateIfNeeded: (( |x|-> type( x ) == "template" ? *x :x ))
  server: (( caSpec.instantiateIfNeeded( .servers[.landscape.cert-manager.server.url] || .landscape.cert-manager.server ) ))
  url: (( server.url || server ))
  ca: (( server.ca || ~~ ))

plugins:
  - kubectl: namespace
  - pinned:
    - helm:
      - helm
      - template
    - kubectl: helm
  - webhookready
  - -echo: (( .settings.self-signed ? ( .settings.ca.given ? "Using provided CA" :"Using self-signed CA" ) :"Using ACME server at " .caSpec.url ))
  - kubectl: issuer

namespace:
  name: (( settings.namespace ))
  kubeconfig: (( landscape.clusters.[0].kubeconfig ))
  manifests:
    - apiVersion: v1
      kind: Namespace
      metadata:
        labels:
          cert-manager.io/disable-validation: "true"
        name: (( .namespace.name ))

webhookready:
  kubeconfig: (( .landscape.clusters.[0].kubeconfig ))
  namespace: (( .settings.namespace ))

issuer: (( .settings.self-signed ? *ca_issuer :*acme_issuer ))

issuer-secret:
  - <<: (( &template &temporary ))
  - apiVersion: v1
    kind: Secret
    type: Opaque
    metadata:
      name: (( settings.issuerName "-secret" ))
      namespace: (( .settings.namespace ))
    data:
      tls.key: (( base64(settings.issuerPrivateKey) ))

acme_issuer:
  <<: (( &template &temporary ))
  kubeconfig: (( landscape.clusters.[0].kubeconfig ))
  manifests:
    - <<: (( valid( .settings.issuerPrivateKey ) ? *issuer-secret :~ ))
    - apiVersion: cert-manager.io/v1
      kind: ClusterIssuer
      metadata:
        name: (( settings.issuerName ))
      spec:
        acme:
          server: (( .caSpec.url ))
          email: (( .landscape.cert-manager.email || .landscape.identity.users[0].email ))
          privateKeySecretRef:
            name: (( settings.issuerName "-secret" ))
          solvers:
            - dns01:
                webhook:
                  groupName: (( settings.groupName ))
                  solverName: (( settings.solverName ))
                  config:
                    dns-class: (( .imports.dns-controller.export.dns-class ))
                    namespace: (( .imports.dns-controller.export.namespace ))
                    ttl: (( .landscape.defaultTTL ))

ca_issuer:
  <<: (( &template &temporary ))
  kubeconfig: (( landscape.clusters.[0].kubeconfig ))
  manifests:
    - apiVersion: v1
      kind: Secret
      metadata:
        name: (( .settings.caSecret ))
        namespace: (( .settings.namespace ))
      type: kubernetes.io/tls
      data:
        tls.crt: (( base64( .settings.ca.crt ) ))
        tls.key: (( base64( .settings.ca.key ) ))
    - apiVersion: cert-manager.io/v1
      kind: ClusterIssuer
      metadata:
        name: (( settings.issuerName ))
      spec:
        ca:
          secretName: (( .settings.caSecret ))

servers:
  <<: (( &temporary ))
  live: https://acme-v02.api.letsencrypt.org/directory
  staging:
    <<: (( &template )) # to not download the letsencrypt certs every time
    url: https://acme-staging-v02.api.letsencrypt.org/directory
    ca:
      crt: (( exec( "curl", "-s", "https://letsencrypt.org/certs/fakelerootx1.pem" ) "\n" exec( "curl", "-s", "https://letsencrypt.org/certs/fakeleintermediatex1.pem" ) ))

helm:
  kubeconfig: (( landscape.clusters.[0].kubeconfig ))
  files:
    - "helm/rendered_charts.yaml"
  source: "chart-checkout/charts/cert-manager"
  name: cert-manager
  namespace: (( .namespace.name ))
  values:
    image:
      repository: (( .landscape.versions.cert-manager.controller.image_repo || ~~ ))
      tag: (( .landscape.versions.cert-manager.controller.image_tag || ~~ ))
    serviceAccount:
      create: true
      name: (( .settings.serviceAccountName ))
    installCRDs: true

state:
  <<: (( &state(merge none) ))
  ca: (( .settings.self-signed -and ( ! .settings.ca.given ) ? ( utilities.certs.selfSignedCA("self-signed-ca", false) ) :~~ ))