{{- $ca := genCA "svc-cat-ca" 3650 }}
{{- $cn := include "stash.fullname" . -}}
{{- $altName1 := printf "%s.%s" $cn .Release.Namespace }}
{{- $altName2 := printf "%s.%s.svc" $cn .Release.Namespace }}
{{- $cert := genSignedCert $cn nil (list $altName1 $altName2) 3650 $ca }}
apiVersion: apiregistration.k8s.io/v1beta1
kind: APIService
metadata:
  name: v1alpha1.admission.stash.appscode.com
  labels:
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app: "{{ template "stash.name" . }}"
    heritage: "{{ .Release.Service }}"
    release: "{{ .Release.Name }}"
spec:
  group: admission.stash.appscode.com
  version: v1alpha1
  service:
    namespace: {{ .Release.Namespace }}
    name: {{ template "stash.fullname" . }}
  caBundle: {{ b64enc $ca.Cert }}
  groupPriorityMinimum: {{ .Values.apiserver.groupPriorityMinimum }}
  versionPriority: {{ .Values.apiserver.versionPriority }}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "stash.fullname" . }}-apiserver-cert
  labels:
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app: "{{ template "stash.name" . }}"
    heritage: "{{ .Release.Service }}"
    release: "{{ .Release.Name }}"
type: Opaque
data:
  tls.crt: {{ b64enc $cert.Cert }}
  tls.key: {{ b64enc $cert.Key }}
---
{{ if .Values.rbac.create }}
# to read the config for terminating authentication
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ template "stash.fullname" . }}-apiserver-extension-server-authentication-reader
  namespace: kube-system
  labels:
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app: "{{ template "stash.name" . }}"
    heritage: "{{ .Release.Service }}"
    release: "{{ .Release.Name }}"
roleRef:
  kind: Role
  apiGroup: rbac.authorization.k8s.io
  name: extension-apiserver-authentication-reader
subjects:
- kind: ServiceAccount
  name: {{ template "stash.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
---
# to delegate authentication and authorization
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ template "stash.fullname" . }}-apiserver-auth-delegator
  labels:
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app: "{{ template "stash.name" . }}"
    heritage: "{{ .Release.Service }}"
    release: "{{ .Release.Name }}"
roleRef:
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: {{ template "stash.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
{{ end }}