{{- if .Values.servingCert.enabled }}
# Two-step CA chain inside cert-manager — required because cert-manager's
# Certificate CR cannot self-sign a leaf in one operation. The flow is:
#
#   1. SelfSigned Issuer  →  signs anything that asks
#   2. Root CA Certificate (issued by SelfSigned, isCA=true)
#   3. CA Issuer that uses the Root CA secret
#   4. Leaf serving Certificate (issued by the CA Issuer)
#
# The leaf's caBundle is what `cert-manager.io/inject-ca-from` on the
# APIService reads to splice trust into the kube-apiserver. Same shape
# every cert-manager external webhook uses; lifted from
# https://cert-manager.io/docs/configuration/acme/dns01/webhook/.
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: {{ include "bp-cert-manager-powerdns-webhook.selfSignedIssuer" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-cert-manager-powerdns-webhook.labels" . | nindent 4 }}
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ include "bp-cert-manager-powerdns-webhook.rootCACertificate" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-cert-manager-powerdns-webhook.labels" . | nindent 4 }}
spec:
  secretName: {{ include "bp-cert-manager-powerdns-webhook.rootCACertificate" . }}
  duration: {{ .Values.servingCert.caDuration }}
  isCA: true
  # X.509 subject CN is capped at 64 bytes (RFC 5280 §4.1.2.4 + the
  # ub-common-name-length=64 PKIX upper bound). The Helm `fullname`
  # template prefixes the chart name with the release name, which —
  # combined with the long `bp-cert-manager-powerdns-webhook` chart name
  # and the `ca.` + `.cert-manager` decoration — overshoots 64 bytes
  # whenever the operator gives this release any non-trivial name (e.g.
  # the bootstrap-kit's `cert-manager-powerdns-webhook` releaseName
  # produces a 78-char CN). cert-manager's webhook then rejects the
  # Certificate at admission with `spec.commonName: Too long`. Closes #508.
  #
  # Use the chart `name` (always `bp-cert-manager-powerdns-webhook`,
  # capped at 63 chars by the .name helper) instead of the release-name-
  # prefixed `fullname`. The CA cert's CN is opaque identity only — no
  # client validates by hostname against this CN — so collapsing on the
  # chart name is safe and stable across releaseName variations.
  commonName: "ca.{{ include "bp-cert-manager-powerdns-webhook.name" . }}.cert-manager"
  privateKey:
    rotationPolicy: Always
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: {{ include "bp-cert-manager-powerdns-webhook.selfSignedIssuer" . }}
    kind: Issuer
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: {{ include "bp-cert-manager-powerdns-webhook.rootCAIssuer" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-cert-manager-powerdns-webhook.labels" . | nindent 4 }}
spec:
  ca:
    secretName: {{ include "bp-cert-manager-powerdns-webhook.rootCACertificate" . }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ include "bp-cert-manager-powerdns-webhook.servingCertificate" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-cert-manager-powerdns-webhook.labels" . | nindent 4 }}
spec:
  secretName: {{ include "bp-cert-manager-powerdns-webhook.servingCertificate" . }}
  duration: {{ .Values.servingCert.duration }}
  renewBefore: {{ .Values.servingCert.renewBefore }}
  privateKey:
    rotationPolicy: Always
    algorithm: ECDSA
    size: 256
  # cert-manager's Service-DNS name is what the kube-apiserver
  # presents to the webhook; the leaf cert MUST list both forms so
  # the TLS handshake succeeds regardless of which name kube uses.
  dnsNames:
    - {{ include "bp-cert-manager-powerdns-webhook.fullname" . }}
    - {{ include "bp-cert-manager-powerdns-webhook.fullname" . }}.{{ .Release.Namespace }}
    - {{ include "bp-cert-manager-powerdns-webhook.fullname" . }}.{{ .Release.Namespace }}.svc
  issuerRef:
    name: {{ include "bp-cert-manager-powerdns-webhook.rootCAIssuer" . }}
    kind: Issuer
{{- end }}
