{{- if .Values.certs.web.create }}
{{ $fullname := include "dex.fullname" . }}
{{ $tlsBuiltName := printf "%s-tls" $fullname }}
{{ $tlsSecretName := default $tlsBuiltName .Values.certs.web.secret.tlsName }}
{{ $caBuiltName := printf "%s-ca" $fullname }}
{{ $caName := default $caBuiltName .Values.certs.web.secret.caName }}
{{ $local := dict "i" 0 }}
apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    "helm.sh/hook": post-install
    "helm.sh/hook-weight": "1"
    "helm.sh/hook-delete-policy": hook-succeeded
  name: {{ $fullname  }}-web-certs
  labels:
    app: {{ template "dex.name" . }}
    chart: {{ template "dex.chart" . }}
    heritage: "{{ .Release.Service }}"
    release: "{{ .Release.Name }}"
    component: "job"
spec:
  activeDeadlineSeconds: {{ .Values.certs.web.activeDeadlineSeconds }}
  template:
    metadata:
      labels:
        app: {{ template "dex.name" . }}
        release: "{{ .Release.Name }}"
        component: "job"
    spec:
      serviceAccountName: {{ template "dex.serviceAccountName" . }}
      restartPolicy: OnFailure
      containers:
      - name: main
        image: "{{ .Values.certs.image }}:{{ .Values.certs.imageTag }}"
        imagePullPolicy: {{ .Values.certs.imagePullPolicy }}
        command:
        - /bin/bash
        - -exc
        - |
          cat << EOF > req.cnf
          [req]
          req_extensions = v3_req
          distinguished_name = req_distinguished_name

          [req_distinguished_name]

          [ v3_req ]
          basicConstraints = CA:FALSE
          keyUsage = nonRepudiation, digitalSignature, keyEncipherment
          subjectAltName = @alt_names

          [alt_names]
          {{- $_ := set $local "i" 1 }}
          {{- range .Values.certs.web.altNames }}
          DNS.{{ $local.i }} = {{ . }}
          {{- $_ := set $local "i" ( add1 $local.i ) }}
          {{- end }}
          {{- $_ := set $local "i" 1 }}
          {{- range .Values.certs.web.altIPs }}
          IP.{{ $local.i }} = {{ . }}
          {{- $_ := set $local "i" ( add1 $local.i ) }}
          {{- end }}
          EOF

          openssl genrsa -out ca-key.pem 2048;
          openssl req -x509 -new -nodes -key ca-key.pem -days {{ .Values.certs.web.caDays }} -out ca.pem -subj "/CN=dex-ca";

          openssl genrsa -out key.pem 2048;
          openssl req -new -key key.pem -out csr.pem -subj "/CN=dex" -config req.cnf;
          openssl x509 -req -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -days {{ .Values.certs.web.certDays }} -extensions v3_req -extfile req.cnf;

          kubectl delete configmap {{ $caName | quote }} --namespace {{ .Release.Namespace }} || true
          kubectl delete secret {{ $caName | quote }} {{ $tlsSecretName }} --namespace {{ .Release.Namespace }} || true

          kubectl create configmap {{ $caName | quote }} --namespace {{ .Release.Namespace }} --from-file dex-ca.pem=ca.pem;
          kubectl create secret tls {{ $caName | quote }} --namespace {{ .Release.Namespace }} --cert=ca.pem --key=ca-key.pem;
          kubectl create secret tls {{ $tlsSecretName }} --namespace {{ .Release.Namespace }} --cert=cert.pem --key=key.pem;
{{- if .Values.inMiniKube }}
          cp -a ca.pem /var/lib/localkube/oidc.pem
        volumeMounts:
        - mountPath: /var/lib/localkube
          name: localkube
      volumes:
      - name: localkube
        hostPath:
          path: /var/lib/localkube
{{- end }}
{{- end }}
