# helm_charts_job-web-certs.yaml
{{- if .Values.certs.web.create }}
{{ $fullname := include "dex.fullname" . }}
{{ $tlsBuiltName := printf "%s-tls" $fullname }}
{{ $tlsSecretName := default $tlsBuiltName .Values.certs.web.secret.tlsName }}
{{ $caBuiltName := printf "%s-ca" $fullname }}
{{ $caName := default $caBuiltName .Values.certs.web.secret.caName }}
{{ $local := dict "i" 0 }}
apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    "helm.sh/hook": post-install
    "helm.sh/hook-weight": "1"
    "helm.sh/hook-delete-policy": hook-succeeded
  name: {{ $fullname  }}-web-certs
  labels:
{{ include "dex.labels" . | indent 4 }}
    app.kubernetes.io/component: "job-web-certs"
spec:
  activeDeadlineSeconds: {{ .Values.certs.web.activeDeadlineSeconds }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ include "dex.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name }}
        app.kubernetes.io/component: "job"
{{- if .Values.certs.web.pod.annotations }}
      annotations:
{{ toYaml .Values.certs.web.pod.annotations | trim | indent 8 }}
{{- end }}
    spec:
      {{- if .Values.certs.securityContext.enabled }}
      securityContext:
        runAsUser: {{ .Values.certs.securityContext.runAsUser }}
        fsGroup: {{ .Values.certs.securityContext.fsGroup }}
      {{- end }}
      serviceAccountName: {{ template "dex.serviceAccountName" . }}
      nodeSelector:
{{ toYaml .Values.certs.web.pod.nodeSelector | indent 8 }}
{{- with .Values.certs.web.pod.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.certs.web.pod.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
{{- end }}
      restartPolicy: OnFailure
      containers:
      - name: main
        image: "{{ .Values.certs.image }}:{{ .Values.certs.imageTag }}"
        imagePullPolicy: {{ .Values.certs.imagePullPolicy }}
        env:
        - name: HOME
          value: /tmp
        workingDir: /tmp
        command:
        - /bin/bash
        - -exc
        - |
          cat << EOF > req.cnf
          [req]
          req_extensions = v3_req
          distinguished_name = req_distinguished_name

          [req_distinguished_name]

          [ v3_req ]
          basicConstraints = CA:FALSE
          keyUsage = nonRepudiation, digitalSignature, keyEncipherment
          subjectAltName = @alt_names

          [alt_names]
          {{- $_ := set $local "i" 1 }}
          {{- range .Values.certs.web.altNames }}
          DNS.{{ $local.i }} = {{ . }}
          {{- $_ := set $local "i" ( add1 $local.i ) }}
          {{- end }}
          {{- $_ := set $local "i" 1 }}
          {{- range .Values.certs.web.altIPs }}
          IP.{{ $local.i }} = {{ . }}
          {{- $_ := set $local "i" ( add1 $local.i ) }}
          {{- end }}
          EOF

          openssl genrsa -out ca-key.pem 2048;
          openssl req -x509 -new -nodes -key ca-key.pem -days {{ .Values.certs.web.caDays }} -out ca.pem -subj "/CN=dex-ca";

          openssl genrsa -out key.pem 2048;
          openssl req -new -key key.pem -out csr.pem -subj "/CN=dex" -config req.cnf;
          openssl x509 -req -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -days {{ .Values.certs.web.certDays }} -extensions v3_req -extfile req.cnf;

          kubectl delete configmap {{ $caName | quote }} --namespace {{ .Release.Namespace }} || true
          kubectl delete secret {{ $caName | quote }} {{ $tlsSecretName }} --namespace {{ .Release.Namespace }} || true

          kubectl create configmap {{ $caName | quote }} --namespace {{ .Release.Namespace }} --from-file dex-ca.pem=ca.pem;
          kubectl create secret tls {{ $caName | quote }} --namespace {{ .Release.Namespace }} --cert=ca.pem --key=ca-key.pem;
          kubectl create secret tls {{ $tlsSecretName }} --namespace {{ .Release.Namespace }} --cert=cert.pem --key=key.pem;
{{- if .Values.inMiniKube }}
          cp -a ca.pem /var/lib/localkube/oidc.pem
        volumeMounts:
        - mountPath: /var/lib/localkube
          name: localkube
      volumes:
      - name: localkube
        hostPath:
          path: /var/lib/localkube
{{- end }}
{{- end }}