{{- if .Values.admissionWebhooks.certManager.enabled -}}
{{- if not .Values.admissionWebhooks.certManager.issuer -}}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: {{ template "vm-operator.fullname" . }}-root
  namespace: {{ .Release.Namespace }}
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ template "vm-operator.fullname" . }}-root-ca
  namespace: {{ .Release.Namespace }}
spec:
  secretName: {{ template "vm-operator.fullname" . }}-root-ca
  duration: 63800h0m0s
  issuerRef:
    name: {{ template "vm-operator.fullname" . }}-root
  commonName: "ca.validation.victoriametrics"
  isCA: true
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: {{ template "vm-operator.fullname" . }}-issuer
  namespace: {{ .Release.Namespace }}
spec:
  ca:
    secretName: {{ template "vm-operator.fullname" . }}-root-ca
{{- end }}
---
# actual cert part for operator
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ template "vm-operator.fullname" . }}-validation
  namespace: {{ .Release.Namespace }}
spec:
  secretName: {{ template "vm-operator.fullname" . }}-validation
  duration: 45800h0m0s
  issuerRef:
    {{- if .Values.admissionWebhooks.certManager.issuer }}
    {{- range $k, $v :=  .Values.admissionWebhooks.certManager.issuer }}
     {{ $k}}: {{ $v}}
    {{- end }}
    {{- else }}
    name: {{ template "vm-operator.fullname" . }}-issuer
  {{- end }}
  dnsNames:
    - {{ template "vm-operator.fullname" . }}
    - {{ template "vm-operator.fullname" . }}.{{ .Release.Namespace }}
    - {{ template "vm-operator.fullname" . }}.{{ .Release.Namespace }}.svc
{{- end -}}