text: {{- if .Values.tlsSecret.create }}
    {{- include "sch.config.init" (list . "discovery.admin.sch.chart.config.values") -}}
    {{- $secretName := include "discovery.admin.tlsSecret" . -}}
    {{- $jobName := (include "sch.names.fullCompName" (list . .sch.chart.components.tlsGenJob.name)) }}
    {{- $crust := (index .Values.global.components "ibm-watson-discovery-crust-prod").releaseName }}
    {{- $core := (index .Values.global.components "ibm-watson-discovery-core-prod").releaseName }}
    {{- $mantle := (index .Values.global.components "ibm-watson-discovery-mantle-prod").releaseName }}
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: {{ $jobName }}
    labels:
  {{  include "sch.metadata.labels.standard" (list . ) | indent 4 }}
  spec:
    backoffLimit: 8
    template:
      metadata:
        annotations:
  {{- include "sch.metadata.annotations.metering" (list . .sch.chart.metering) | indent 8 }}
        name: {{ $jobName }}
        labels:
  {{  include "sch.metadata.labels.standard" (list . )  | indent 8 }}
      spec:
        affinity:
  {{- include "sch.affinity.nodeAffinity" (list .) | indent 8 }}
  
        hostNetwork: false
        hostPID: false
        hostIPC: false
  {{ include "sch.security.securityContext" (list . .sch.chart.restrictedPodSecurityContext) | indent 6 }}
        restartPolicy: Never
        serviceAccountName: {{ .Values.global.privilegedServiceAccount.name }}
        imagePullSecrets:
        - name: {{ .Values.global.image.pullSecret }}
        volumes:
        - name: tls-out
          emptyDir: {}
        containers:
        - name: secret-config
          imagePullPolicy: {{ .Values.global.image.pullPolicy }}
          resources:
            requests:
              memory: {{ .Values.tlsSecret.resources.requests.memory }}
              cpu: {{ .Values.tlsSecret.resources.requests.cpu }}
            limits:
              memory: {{ .Values.tlsSecret.resources.limits.memory }}
              cpu: {{ .Values.tlsSecret.resources.limits.cpu }}
          image: {{ .Values.global.dockerRegistryPrefix }}/
            {{- .Values.tlsSecret.image.name }}:
            {{- .Values.tlsSecret.image.tag }}
  {{ include "sch.security.securityContext" (list . .sch.chart.restrictedSecurityContext) | indent 8 }}
          volumeMounts:
          - name: tls-out
            mountPath: /tmp/secretGen/tls
          command:
          - /bin/bash
          - -c
          - |
             set -euo pipefail
  
             openssl genrsa -out /tmp/secretGen/tls/cert-secret.key 2048
             openssl req -x509 -new -nodes -key /tmp/secretGen/tls/cert-secret.key -days 1095 -extensions san -out /tmp/secretGen/tls/cert-secret.crt \
               -config <(echo "[req]"; echo distinguished_name=req; echo "[san]"; \
                echo subjectAltName=DNS:{{ $crust }}-{{ .Values.global.appName }}-minio-headless-svc, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-minio-headless-svc.{{ .Release.Namespace }}.svc, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-minio-headless-svc.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}, \
                DNS:*.{{ $crust }}-{{ .Values.global.appName }}-minio-headless-svc, \
                DNS:*.{{ $crust }}-{{ .Values.global.appName }}-minio-headless-svc.{{ .Release.Namespace }}.svc, \
                DNS:*.{{ $crust }}-{{ .Values.global.appName }}-minio-headless-svc.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-minio-svc, \
                DNS:*.{{ $crust }}-{{ .Values.global.appName }}-minio-svc, \
                DNS:*.{{ $crust }}-{{ .Values.global.appName }}-minio-svc.{{ .Release.Namespace }}.svc, \
                DNS:*.{{ $crust }}-{{ .Values.global.appName }}-minio-svc.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}, \
                DNS:localhost, \
                IP:127.0.0.1, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-etcd, \
                DNS:*.{{ $crust }}-{{ .Values.global.appName }}-etcd, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-etcd.{{ .Release.Namespace }}.svc, \
                DNS:*.{{ $crust }}-{{ .Values.global.appName }}-etcd.{{ .Release.Namespace }}.svc, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-etcd.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}, \
                DNS:*.{{ $crust }}-{{ .Values.global.appName }}-etcd.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-postgresql, \
                DNS:*.{{ $crust }}-{{ .Values.global.appName }}-postgresql-proxy-svc, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-postgresql-proxy-svc.{{ .Release.Namespace }}.svc, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-postgresql-proxy-svc.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}, \
                DNS:*.{{ $crust }}-{{ .Values.global.appName }}-postgresql-proxy-svc.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-rabbitmq, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-rabbitmq-svc, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-rabbitmq-svc.{{ .Release.Namespace }}.svc, \
                DNS:{{ $crust }}-{{ .Values.global.appName }}-rabbitmq-svc.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}, \
                DNS:elastic, \
                DNS:ibm-elastic, \
                DNS:{{ $mantle }}-{{ .Values.global.appName }}-elastic, \
                DNS:{{ $mantle }}-{{ .Values.global.appName }}-elastic.{{ .Release.Namespace }}.svc, \
                DNS:{{ $mantle }}-{{ .Values.global.appName }}-elastic.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}, \
                DNS:*.{{ $mantle }}-{{ .Values.global.appName }}-elastic.{{ .Release.Namespace }}.svc, \
                DNS:*.{{ $mantle }}-{{ .Values.global.appName }}-elastic.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}, \
                DNS:*.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}, \
                DNS:glimpse-query-svc) \
               -subj "/CN=*.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}"
             openssl pkcs8 -topk8 -inform pem -in /tmp/secretGen/tls/cert-secret.key -outform pem -out /tmp/secretGen/tls/cert-secret.pem -nocrypt
  
             cat <<EOF | kubectl create -f -
             apiVersion: v1
             kind: Secret
             type: kubernetes.io/tls
             metadata:
              name: {{ $secretName }}
              labels:
  {{ include "sch.metadata.labels.standard" (list . ) | indent 14 }}
             data:
              tls.cacrt: $(cat /tmp/secretGen/tls/cert-secret.crt | base64 | tr -d '\n')
              tls.crt: $(cat /tmp/secretGen/tls/cert-secret.crt | base64 | tr -d '\n')
              tls.key: $(cat /tmp/secretGen/tls/cert-secret.key | base64 | tr -d '\n')
              pkcs8.key: $(cat /tmp/secretGen/tls/cert-secret.pem | base64 | tr -d '\n')
              wire-key-passphrase: ""
             EOF
  {{- end }}
  