{{- if .Values.secrets.create }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "concourse.concourse.fullname" . }}
  labels:
    app: {{ template "concourse.concourse.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
type: Opaque
data:
  host-key: {{ .Values.secrets.hostKey | b64enc | quote }}
  host-key-pub: {{ .Values.secrets.hostKeyPub | b64enc | quote }}
  session-signing-key: {{ .Values.secrets.sessionSigningKey | b64enc | quote }}
  worker-key: {{ .Values.secrets.workerKey | b64enc | quote }}
  worker-key-pub: {{ .Values.secrets.workerKeyPub | b64enc | quote }}
  {{- if not .Values.postgresql.enabled }}
  postgresql-uri: {{ template "concourse.secret.required" dict "key" "postgresqlUri" "isnt" "postgresql.enabled" "root" . }}
  {{- end }}
  {{- if .Values.concourse.encryption.enabled }}
  encryption-key: {{ template "concourse.secret.required" dict "key" "encryptionKey" "is" "concourse.encryption.enabled" "root" . }}
  old-encryption-key: {{ default "" .Values.secrets.oldEncryptionKey | b64enc | quote }}
  {{- end }}
  {{- if .Values.concourse.basicAuth.enabled }}
  basic-auth-username: {{ template "concourse.secret.required" dict "key" "basicAuthUsername" "is" "concourse.basicAuth.enabled" "root" . }}
  basic-auth-password: {{ template "concourse.secret.required" dict "key" "basicAuthPassword" "is" "concourse.basicAuth.enabled" "root" . }}
  {{- end }}
  {{- if .Values.concourse.githubAuth.enabled }}
  github-auth-client-id: {{ template "concourse.secret.required" dict "key" "githubAuthClientId" "is" "concourse.githubAuth.enabled" "root" . }}
  github-auth-client-secret: {{ template "concourse.secret.required" dict "key" "githubAuthClientSecret" "is" "concourse.githubAuth.enabled" "root" . }}
  {{- end }}
  {{- if .Values.concourse.gitlabAuth.enabled }}
  gitlab-auth-client-id: {{ template "concourse.secret.required" dict "key" "gitlabAuthClientId" "is" "concourse.gitlabAuth.enabled" "root" . }}
  gitlab-auth-client-secret: {{ template "concourse.secret.required" dict "key" "gitlabAuthClientSecret" "is" "concourse.gitlabAuth.enabled" "root" . }}
  {{- end }}
  {{- if .Values.concourse.genericOauth.enabled }}
  generic-oauth-client-id: {{ template "concourse.secret.required" dict "key" "genericOauthClientId" "is" "concourse.genericOauth.enabled" "root" . }}
  generic-oauth-client-secret: {{ template "concourse.secret.required" dict "key" "genericOauthClientSecret" "is" "concourse.genericOauth.enabled" "root" . }}
  {{- end }}
  {{- if .Values.credentialManager.vault.enabled }}
  vault-ca-cert: {{ default "" .Values.secrets.vaultCaCert | b64enc | quote }}
  vault-client-token: {{ default "" .Values.secrets.vaultClientToken | b64enc | quote }}
  vault-approle-id: {{ default "" .Values.secrets.vaultAppRoleId | b64enc | quote }}
  vault-approle-secret-id: {{ default "" .Values.secrets.vaultAppRoleSecretId | b64enc | quote }}
  vault-client-cert: {{ default "" .Values.secrets.vaultClientCert | b64enc | quote }}
  vault-client-key: {{ default "" .Values.secrets.vaultClientKey | b64enc | quote }}
  {{- end }}
  {{- if .Values.credentialManager.ssm.enabled }}
  aws-ssm-access-key: {{ default "" .Values.secrets.awsSsmAccessKey | b64enc | quote }}
  aws-ssm-secret-key: {{ default "" .Values.secrets.awsSsmSecretKey | b64enc | quote }}
  {{- if .Values.secrets.awsSsmSessionToken }}
  aws-ssm-session-token: {{ .Values.secrets.awsSsmSessionToken | b64enc | quote }}
  {{- end }}
  {{- end }}
  {{- if .Values.credentialManager.awsSecretsManager.enabled }}
  aws-secretsmanager-access-key: {{ default "" .Values.secrets.awsSecretsmanagerAccessKey | b64enc | quote }}
  aws-secretsmanager-secret-key: {{ default "" .Values.secrets.awsSecretsmanagerSecretKey | b64enc | quote }}
  {{- if .Values.secrets.awsSecretsmanagerSessionToken }}
  aws-secretsmanager-session-token: {{ .Values.secrets.awsSecretsmanagerSessionToken | b64enc | quote }}
  {{- end }}
  {{- end }}
  {{- if .Values.web.metrics.influxdb.enabled }}
  influxdb-password: {{ default "" .Values.secrets.influxdbPassword | b64enc | quote }}
  {{- end }}
{{- end }}
